e6e19671365ee87a101f970ebb2e9cdf60a8ef7f20c4500d76e37cab1486a4e1

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.3MB
Sample221005-bds28sdcfq
SHA256 e6e19671365ee87a101f970ebb2e9cdf60a8ef7f20c4500d76e37cab1486a4e1
MD5 2fb58faadfe5eafab886f011b0e6b536
SHA1 e26578bc417158712a950c6e7a71eeccaa9df0cb
SHA512 09612f2ca0337ea02f5334415d475ca2fbc94c2203da9dc53d1653a20ea8b960807591d8ae027766b953ebf3dbf0ce7d39f8565149fd9a56a769ea239b7a2955
SSDEEP 196608:91OY/76yTURfmM2jLWGTmuU8V7xB7c8SjuR:3OYDHUx2fr6tgxBS6R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QrhBhAIewKJHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ryYNpJDBUybU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\yhlYPCkQXcaQbSVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GvoOIxMhypioqxYUWFR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vckoWffGU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GvoOIxMhypioqxYUWFR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ryYNpJDBUybU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QrhBhAIewKJHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rJaJUqPnDsUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rJaJUqPnDsUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vckoWffGU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\yhlYPCkQXcaQbSVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1508	Install.exe
1972	Install.exe
1576	DbGZQsK.exe
1104	eXlrKGh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1084	file.exe
1508	Install.exe
1508	Install.exe
1508	Install.exe
1508	Install.exe
1972	Install.exe
1972	Install.exe
1972	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	eXlrKGh.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	eXlrKGh.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	eXlrKGh.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	DbGZQsK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	eXlrKGh.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	eXlrKGh.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	DbGZQsK.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	DbGZQsK.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	eXlrKGh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	eXlrKGh.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	eXlrKGh.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ryYNpJDBUybU2\gimvPDR.xml	eXlrKGh.exe
File created	C:\Program Files (x86)\vckoWffGU\mEysvm.dll	eXlrKGh.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	eXlrKGh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	eXlrKGh.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	eXlrKGh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	eXlrKGh.exe
File created	C:\Program Files (x86)\vckoWffGU\nvwjxVQ.xml	eXlrKGh.exe
File created	C:\Program Files (x86)\ryYNpJDBUybU2\fmkEAySsmvUmt.dll	eXlrKGh.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bpCIAYFeZyKMHikKBh.job	schtasks.exe
File created	C:\Windows\Tasks\sowxjEWsCulfsCpcT.job	schtasks.exe
File created	C:\Windows\Tasks\gxWNFYjnrIlwkwP.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1992	schtasks.exe
944	schtasks.exe
532	schtasks.exe
1340	schtasks.exe
1116	schtasks.exe
908	schtasks.exe
1348	schtasks.exe
2004	schtasks.exe
988	schtasks.exe
1684	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\7e-b2-ad-6b-7a-8c	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecisionReason = "1"	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecision = "0"	eXlrKGh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadNetworkName = "Network 2"	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	eXlrKGh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	eXlrKGh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionReason = "1"	eXlrKGh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionTime = 8006092467d8d801	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	eXlrKGh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	eXlrKGh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	eXlrKGh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecision = "0"	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	eXlrKGh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	eXlrKGh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	eXlrKGh.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	eXlrKGh.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	eXlrKGh.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1108	powershell.EXE
1108	powershell.EXE
1108	powershell.EXE
2004	powershell.EXE
2004	powershell.EXE
2004	powershell.EXE
816	powershell.EXE
816	powershell.EXE
816	powershell.EXE
1752	powershell.EXE
1752	powershell.EXE
1752	powershell.EXE
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe
1104	eXlrKGh.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	powershell.EXE
Token: SeDebugPrivilege	2004	powershell.EXE
Token: SeDebugPrivilege	816	powershell.EXE
Token: SeDebugPrivilege	1752	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	27
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1508 wrote to memory of 1972	1508	Install.exe	28
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 920	1972	Install.exe	30
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 1972 wrote to memory of 1768	1972	Install.exe	32
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 920 wrote to memory of 1648	920	forfiles.exe	34
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1768 wrote to memory of 852	1768	forfiles.exe	35
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 1648 wrote to memory of 1576	1648	cmd.exe	36
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1544	852	cmd.exe	37
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 852 wrote to memory of 1468	852	cmd.exe	38
PID 1648 wrote to memory of 1480	1648	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:920
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1648
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1576
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1480
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:852
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1544
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1468
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "giKgvwsQn" /SC once /ST 02:06:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1992
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "giKgvwsQn"
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "giKgvwsQn"
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bpCIAYFeZyKMHikKBh" /SC once /ST 03:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\DbGZQsK.exe\" ux /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:944

C:\Windows\system32\taskeng.exe
taskeng.exe {26652E58-D3ED-4184-872A-6483D807D627} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1804

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1560

C:\Windows\system32\taskeng.exe
taskeng.exe {5EBC3EC7-4E69-4EE5-AC2D-97E5AF1CD29D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1564
- C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\DbGZQsK.exe
  C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\DbGZQsK.exe ux /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gPkvKofBL" /SC once /ST 02:29:08 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gPkvKofBL"
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gPkvKofBL"
    3⤵
    PID:824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1088
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1240
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gJKgEiMbY" /SC once /ST 02:42:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gJKgEiMbY"
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gJKgEiMbY"
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:672
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:732
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:976
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\knLrxBGDCryPZEWZ\JBZoMZOy\tFPHAzkRjjvoAiqD.wsf"
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\knLrxBGDCryPZEWZ\JBZoMZOy\tFPHAzkRjjvoAiqD.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1240
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1736
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1404
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1236
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:532
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1408
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1920
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:532
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1388
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gcxpMwxwX" /SC once /ST 01:10:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gcxpMwxwX"
    3⤵
    PID:808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gcxpMwxwX"
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "sowxjEWsCulfsCpcT" /SC once /ST 00:02:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\eXlrKGh.exe\" oy /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "sowxjEWsCulfsCpcT"
    3⤵
    PID:1628
- C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\eXlrKGh.exe
  C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\eXlrKGh.exe oy /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bpCIAYFeZyKMHikKBh"
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:848
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\vckoWffGU\mEysvm.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gxWNFYjnrIlwkwP" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gxWNFYjnrIlwkwP2" /F /xml "C:\Program Files (x86)\vckoWffGU\nvwjxVQ.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "gxWNFYjnrIlwkwP"
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gxWNFYjnrIlwkwP"
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "LmSkNVbcyXknPd" /F /xml "C:\Program Files (x86)\ryYNpJDBUybU2\gimvPDR.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "feKFQCAArapkO2" /F /xml "C:\ProgramData\yhlYPCkQXcaQbSVB\ZFEYsiz.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2004

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:876

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-657436260-180965090934129161510596805782024983978-1387575975-1480983016815500520"
1⤵
- Windows security bypass
PID:1088

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gimvPDR.xml

Path C:\Program Files (x86)\ryYNpJDBUybU2\gimvPDR.xml
Size 2KB
SHA256 0ef3281f868935587c15641e371a49fb6c8716511e29e05eda4c826144f87ac1
MD5 f058e4dca6cc4c76d070e7b25487e0ed
SHA1 0b25c00b4193da838ebf1c9a0b527651ce51c72e
SHA512 49a87b0651aabd440a3dbb60e6bc75e6e2f6c8d221a7995b9d28b8d8995b506641bd4e2f1dc5f90af217aa4f9b6b4538f4d97c88dee121d484f7a95213101f3a
MD5 SHA1 SHA512

Submit Download

nvwjxVQ.xml

Path C:\Program Files (x86)\vckoWffGU\nvwjxVQ.xml
Size 2KB
SHA256 9c16a47186a3d3382a8059b1dd3c045c53995ec0bebe02242ea0280e421c7ca5
MD5 a55eb50f6e5da336ace8a86c5b1857c3
SHA1 5dfeb54f5f1d24d093cd6a5014970fc6fa0611b2
SHA512 cdfe45b720c7bbf2304ce3c58bb3e207d775a22a49cd71158befa636d8d757da9776866aae9d2b448332d70a80876acd20af98c8489eabbf9a4cfe1c3e939403
MD5 SHA1 SHA512

Submit Download

ZFEYsiz.xml

Path C:\ProgramData\yhlYPCkQXcaQbSVB\ZFEYsiz.xml
Size 2KB
SHA256 8755c54241796a697965159907101a2a0b8e66293e48a03a6b0cb5b81af42453
MD5 b740f4679d60fa99a4e063213dffbeba
SHA1 f86ad35a9f9925c0e9f6495dc3d1f4ebdd38f224
SHA512 76b6d87d74877d279d202337cd75927376b1b7134676df1e93a90f208daf52844526121767d068f92e7cda96e2f00373ade50ab37b294b43c947775a8d650c26
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
Size 6.3MB
SHA256 bf0ffb2981e4d10b157d52f801afcc433994e3ba68c6ae817c23e744149d5686
MD5 35ccf2deb535f1a677fd5868c453a1cb
SHA1 31d813c2970889298fa398f82f14e7230b52eb29
SHA512 c80ca0efb287776f1ced2abbe40b34906a41773f24602262297ef5df27b6770de0ce348e3aa8458cdf7e65e017954a3a2cf5682c67790e031004ed88868d0faf
SSDEEP 196608:91OScivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6k:3Ori1DCTeCKKXNIYYjC6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
Size 6.3MB
SHA256 bf0ffb2981e4d10b157d52f801afcc433994e3ba68c6ae817c23e744149d5686
MD5 35ccf2deb535f1a677fd5868c453a1cb
SHA1 31d813c2970889298fa398f82f14e7230b52eb29
SHA512 c80ca0efb287776f1ced2abbe40b34906a41773f24602262297ef5df27b6770de0ce348e3aa8458cdf7e65e017954a3a2cf5682c67790e031004ed88868d0faf
SSDEEP 196608:91OScivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6k:3Ori1DCTeCKKXNIYYjC6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DbGZQsK.exe

Path C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\DbGZQsK.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DbGZQsK.exe

Path C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\DbGZQsK.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 39645e181188e1e8f326443400fea9b4c2d7605f8bfddbef64c554f2a86ca38d
MD5 ba40a4164317283c786c853b35ac6d4c
SHA1 590ca3f22b22849d2feb3236898d84c085a52e17
SHA512 23354ab1c6108c4537a937965fa93e0013d34a61e3378f56685c40654ae073f677f0db0278814abbd0a02d5b449191afb0d14595b039cdfe3a8b023fa20186c2
SSDEEP 96:IxmxCoBM8NnqvsqvJCwoW0v00xmxCoBM8NnqvsEHyqvJCwor80v0VDAzQHEz70Vf:4YRUozYRAHnorKIxz70Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 ef21362e272d39839fa29ad100ff8667b457f49f1cea55486cbc8bd964abf6e2
MD5 e243d9ac0391cb3e0f0e742c515f5587
SHA1 4ee814b9267c0628da0dce05b7946b114342743c
SHA512 b205ee4a02c3bb26d85f197745c7ee4e05e82004aee6fb939e720c1cf150416b5b4449dafaab114cb36af45108ac07094eed207135a45ff9d4d62f0f451b0807
SSDEEP 96:wxmxCoBM8NnqvsqvJCwoW0v0cxmxCoBM8NnqvsEHyqvJCwor80v0VDAzQHEz70Vf:gYRUoDYRAHnorKIxz70Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c2af8aca690c85a36cc44082d0072773abe5883703b94494a8aced88ad61bb18
MD5 6473e41013df536e608d8c340d46f31f
SHA1 644040da4e88af9ee9676768f39beb90b96825ba
SHA512 4061e83e545bec50d8be8687055a105e0b30fa2aac9443146c91a94f4f358d375c35e1930a3bc6a32171d5e438f1394f08d35e6ad69b2a1d824c6cdec0c6c4e4
SSDEEP 96:4xmxCoBM8NnqvsqvJCwoW0v00xmxCoBM8NnqvsEHyqvJCwor80v0VDAzQHEz70Vf:oYRUo7YRAHnorKIxz70Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXlrKGh.exe

Path C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\eXlrKGh.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXlrKGh.exe

Path C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\eXlrKGh.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tFPHAzkRjjvoAiqD.wsf

Path C:\Windows\Temp\knLrxBGDCryPZEWZ\JBZoMZOy\tFPHAzkRjjvoAiqD.wsf
Size 8KB
SHA256 44309aba9e748ce64f7d81407d6f008ea407d0cc39856f74ad873524f0b03117
MD5 abdf4ed6cdaca23e1d21df23062d1077
SHA1 f09f51546f3b440388ed78476aaa08732c72e707
SHA512 b69a0107730bf2cbdb3281b4007d7d207a98a8cbc260d8d1e170755060ee3dd051911d0826d8bf7e6a7ed10943ddb5b1624f5e5b48d745b61f77a6aa202ac4ec
SSDEEP 96:oeCAswsEyAysKsqI3fs7JmX/k3Xx3oq5xmucyeucyNndeucymucybucyYyLr7teF:9swsEyAysKsqms7t3oKhzlpc7P7fnRql
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 4KB
SHA256 c4c9dbbbaa374c35fe98eca1e7739599943f21232a5a85a555ad8e06d8f28d10
MD5 08c25cc19eee42b098c809cfb803c736
SHA1 841b00c0b3245151e8f30b6e92f92d5b3f12ef77
SHA512 cff98c41690f5f76d1274bc62d685c113d5508de4ab6a0a83c4a6e96759a4d99fae0e1d9ea1548c07a490d78ca0de8439c13c4b2f2fe423e6a245a84e73bc813
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9nyJ0s0R0l0p0U0B0I0wT:E
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
Size 6.3MB
SHA256 bf0ffb2981e4d10b157d52f801afcc433994e3ba68c6ae817c23e744149d5686
MD5 35ccf2deb535f1a677fd5868c453a1cb
SHA1 31d813c2970889298fa398f82f14e7230b52eb29
SHA512 c80ca0efb287776f1ced2abbe40b34906a41773f24602262297ef5df27b6770de0ce348e3aa8458cdf7e65e017954a3a2cf5682c67790e031004ed88868d0faf
SSDEEP 196608:91OScivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6k:3Ori1DCTeCKKXNIYYjC6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
Size 6.3MB
SHA256 bf0ffb2981e4d10b157d52f801afcc433994e3ba68c6ae817c23e744149d5686
MD5 35ccf2deb535f1a677fd5868c453a1cb
SHA1 31d813c2970889298fa398f82f14e7230b52eb29
SHA512 c80ca0efb287776f1ced2abbe40b34906a41773f24602262297ef5df27b6770de0ce348e3aa8458cdf7e65e017954a3a2cf5682c67790e031004ed88868d0faf
SSDEEP 196608:91OScivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6k:3Ori1DCTeCKKXNIYYjC6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
Size 6.3MB
SHA256 bf0ffb2981e4d10b157d52f801afcc433994e3ba68c6ae817c23e744149d5686
MD5 35ccf2deb535f1a677fd5868c453a1cb
SHA1 31d813c2970889298fa398f82f14e7230b52eb29
SHA512 c80ca0efb287776f1ced2abbe40b34906a41773f24602262297ef5df27b6770de0ce348e3aa8458cdf7e65e017954a3a2cf5682c67790e031004ed88868d0faf
SSDEEP 196608:91OScivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6k:3Ori1DCTeCKKXNIYYjC6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSA3E.tmp\Install.exe
Size 6.3MB
SHA256 bf0ffb2981e4d10b157d52f801afcc433994e3ba68c6ae817c23e744149d5686
MD5 35ccf2deb535f1a677fd5868c453a1cb
SHA1 31d813c2970889298fa398f82f14e7230b52eb29
SHA512 c80ca0efb287776f1ced2abbe40b34906a41773f24602262297ef5df27b6770de0ce348e3aa8458cdf7e65e017954a3a2cf5682c67790e031004ed88868d0faf
SSDEEP 196608:91OScivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6k:3Ori1DCTeCKKXNIYYjC6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSE34.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/816-135-0x000007FEF2310000-0x000007FEF2E6D000-memory.dmp

Download

memory/816-137-0x0000000002624000-0x0000000002627000-memory.dmp

Download

memory/816-134-0x000007FEF2F30000-0x000007FEF3953000-memory.dmp

Download

memory/816-138-0x000000000262B000-0x000000000264A000-memory.dmp

Download

memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Download

memory/1104-193-0x0000000002F20000-0x0000000002FA5000-memory.dmp

Download

memory/1104-197-0x0000000003160000-0x00000000031C3000-memory.dmp

Download

memory/1108-97-0x000007FEF2F70000-0x000007FEF3ACD000-memory.dmp

Download

memory/1108-101-0x0000000002494000-0x0000000002497000-memory.dmp

Download

memory/1108-99-0x0000000002494000-0x0000000002497000-memory.dmp

Download

memory/1108-102-0x000000000249B000-0x00000000024BA000-memory.dmp

Download

memory/1108-95-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Download

memory/1108-96-0x000007FEF3AD0000-0x000007FEF44F3000-memory.dmp

Download

memory/1108-98-0x000000001B790000-0x000000001BA8F000-memory.dmp

Download

memory/1752-178-0x000007FEF3040000-0x000007FEF3A63000-memory.dmp

Download

memory/1752-182-0x00000000025DB000-0x00000000025FA000-memory.dmp

Download

memory/1752-181-0x00000000025D4000-0x00000000025D7000-memory.dmp

Download

memory/1752-180-0x000000001B700000-0x000000001B9FF000-memory.dmp

Download

memory/1752-179-0x000007FEF24E0000-0x000007FEF303D000-memory.dmp

Download

memory/1972-71-0x0000000010000000-0x0000000010940000-memory.dmp

Download

memory/2004-120-0x000007FEF2FA0000-0x000007FEF39C3000-memory.dmp

Download

memory/2004-122-0x0000000002390000-0x0000000002410000-memory.dmp

Download

memory/2004-121-0x000007FEF2380000-0x000007FEF2EDD000-memory.dmp

Download