4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
Size

1016KB
MD5

78faaaf754300195e42338290beef920
SHA1

6e35d65b45bbd635018e87574f6d95a44720d4f2
SHA256

4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f
SHA512

f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577
SSDEEP

6144:PIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:PIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	egotr.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	egotr.exe

Adds policy Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "iwqhrhxpjyyhajhvo.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "bohxgvkbuihphpmz.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "rgbtevmfaqrbvfetnm.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bohxgvkbuihphpmz.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "iwqhrhxpjyyhajhvo.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bohxgvkbuihphpmz.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cgqxxdj = "bohxgvkbuihphpmz.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vwdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe"	egotr.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egotr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egotr.exe

Executes dropped EXE 3 IoCs

pid	Process
4956	yborjrewily.exe
620	egotr.exe
400	egotr.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "pgdxkdwrogjvrdevrslc.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wesdhrbnbke = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "ewupdxrnleivsfhzwyski.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ioajltblx = "iwqhrhxpjyyhajhvo.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "pgdxkdwrogjvrdevrslc.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bivfiralyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wesdhrbnbke = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pgdxkdwrogjvrdevrslc.exe ."	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "bohxgvkbuihphpmz.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "ewupdxrnleivsfhzwyski.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ioajltblx = "rgbtevmfaqrbvfetnm.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe ."	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bohxgvkbuihphpmz.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bivfiralyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe ."	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "iwqhrhxpjyyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wesdhrbnbke = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bivfiralyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bohxgvkbuihphpmz.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "bohxgvkbuihphpmz.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wesdhrbnbke = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "iwqhrhxpjyyhajhvo.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "bohxgvkbuihphpmz.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "rgbtevmfaqrbvfetnm.exe"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wesdhrbnbke = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iwqhrhxpjyyhajhvo.exe"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ioajltblx = "ewupdxrnleivsfhzwyski.exe ."	egotr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "ewupdxrnleivsfhzwyski.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "csohtldxtkmxsddtoog.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ioajltblx = "rgbtevmfaqrbvfetnm.exe ."	egotr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wesdhrbnbke = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pgdxkdwrogjvrdevrslc.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "bohxgvkbuihphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "rgbtevmfaqrbvfetnm.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ioajltblx = "iwqhrhxpjyyhajhvo.exe ."	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rwhpqxen = "pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ioajltblx = "bohxgvkbuihphpmz.exe ."	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bivfiralyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewupdxrnleivsfhzwyski.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egotr = "iwqhrhxpjyyhajhvo.exe"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "rgbtevmfaqrbvfetnm.exe ."	egotr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rgbtevmfaqrbvfetnm.exe"	egotr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bivfiralyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csohtldxtkmxsddtoog.exe ."	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bohxgvkbuihphpmz.exe"	egotr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egotr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pgdxkdwrogjvrdevrslc.exe"	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\psbhgl = "ewupdxrnleivsfhzwyski.exe ."	egotr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bivfiralyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csohtldxtkmxsddtoog.exe ."	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	egotr.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	egotr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	egotr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	whatismyip.everdot.org
58	whatismyip.everdot.org
66	whatismyip.everdot.org
30	www.showmyipaddress.com
32	whatismyip.everdot.org
33	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pgdxkdwrogjvrdevrslc.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\vonjytolkejxvjmfdgbutp.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\rgbtevmfaqrbvfetnm.exe	egotr.exe
File created	C:\Windows\SysWOW64\scsflxjxnyuzotnxmgscsflxjxnyuzotnxm.scs	egotr.exe
File opened for modification	C:\Windows\SysWOW64\csohtldxtkmxsddtoog.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\iwqhrhxpjyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\ewupdxrnleivsfhzwyski.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\vonjytolkejxvjmfdgbutp.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\bohxgvkbuihphpmz.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\iwqhrhxpjyyhajhvo.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\csohtldxtkmxsddtoog.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\pgdxkdwrogjvrdevrslc.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\bohxgvkbuihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\scsflxjxnyuzotnxmgscsflxjxnyuzotnxm.scs	egotr.exe
File created	C:\Windows\SysWOW64\jinpklmpuufzdxgfjstsxzuv.zee	egotr.exe
File opened for modification	C:\Windows\SysWOW64\iwqhrhxpjyyhajhvo.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\jinpklmpuufzdxgfjstsxzuv.zee	egotr.exe
File opened for modification	C:\Windows\SysWOW64\rgbtevmfaqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\csohtldxtkmxsddtoog.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\pgdxkdwrogjvrdevrslc.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\ewupdxrnleivsfhzwyski.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\rgbtevmfaqrbvfetnm.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\ewupdxrnleivsfhzwyski.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\vonjytolkejxvjmfdgbutp.exe	egotr.exe
File opened for modification	C:\Windows\SysWOW64\bohxgvkbuihphpmz.exe	egotr.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jinpklmpuufzdxgfjstsxzuv.zee	egotr.exe
File opened for modification	C:\Program Files (x86)\scsflxjxnyuzotnxmgscsflxjxnyuzotnxm.scs	egotr.exe
File created	C:\Program Files (x86)\scsflxjxnyuzotnxmgscsflxjxnyuzotnxm.scs	egotr.exe
File opened for modification	C:\Program Files (x86)\jinpklmpuufzdxgfjstsxzuv.zee	egotr.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\jinpklmpuufzdxgfjstsxzuv.zee	egotr.exe
File created	C:\Windows\scsflxjxnyuzotnxmgscsflxjxnyuzotnxm.scs	egotr.exe
File opened for modification	C:\Windows\csohtldxtkmxsddtoog.exe	egotr.exe
File opened for modification	C:\Windows\bohxgvkbuihphpmz.exe	egotr.exe
File opened for modification	C:\Windows\bohxgvkbuihphpmz.exe	egotr.exe
File opened for modification	C:\Windows\rgbtevmfaqrbvfetnm.exe	egotr.exe
File opened for modification	C:\Windows\ewupdxrnleivsfhzwyski.exe	egotr.exe
File opened for modification	C:\Windows\vonjytolkejxvjmfdgbutp.exe	egotr.exe
File opened for modification	C:\Windows\pgdxkdwrogjvrdevrslc.exe	egotr.exe
File opened for modification	C:\Windows\jinpklmpuufzdxgfjstsxzuv.zee	egotr.exe
File opened for modification	C:\Windows\rgbtevmfaqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\vonjytolkejxvjmfdgbutp.exe	yborjrewily.exe
File opened for modification	C:\Windows\scsflxjxnyuzotnxmgscsflxjxnyuzotnxm.scs	egotr.exe
File opened for modification	C:\Windows\csohtldxtkmxsddtoog.exe	egotr.exe
File opened for modification	C:\Windows\bohxgvkbuihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\csohtldxtkmxsddtoog.exe	yborjrewily.exe
File opened for modification	C:\Windows\ewupdxrnleivsfhzwyski.exe	yborjrewily.exe
File opened for modification	C:\Windows\iwqhrhxpjyyhajhvo.exe	egotr.exe
File opened for modification	C:\Windows\pgdxkdwrogjvrdevrslc.exe	egotr.exe
File opened for modification	C:\Windows\iwqhrhxpjyyhajhvo.exe	egotr.exe
File opened for modification	C:\Windows\rgbtevmfaqrbvfetnm.exe	egotr.exe
File opened for modification	C:\Windows\ewupdxrnleivsfhzwyski.exe	egotr.exe
File opened for modification	C:\Windows\iwqhrhxpjyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\pgdxkdwrogjvrdevrslc.exe	yborjrewily.exe
File opened for modification	C:\Windows\vonjytolkejxvjmfdgbutp.exe	egotr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
620	egotr.exe
620	egotr.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
620	egotr.exe
620	egotr.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	egotr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4956	3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	82
PID 3932 wrote to memory of 4956	3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	82
PID 3932 wrote to memory of 4956	3932	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	82
PID 4956 wrote to memory of 620	4956	yborjrewily.exe	84
PID 4956 wrote to memory of 620	4956	yborjrewily.exe	84
PID 4956 wrote to memory of 620	4956	yborjrewily.exe	84
PID 4956 wrote to memory of 400	4956	yborjrewily.exe	83
PID 4956 wrote to memory of 400	4956	yborjrewily.exe	83
PID 4956 wrote to memory of 400	4956	yborjrewily.exe	83

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	egotr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egotr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	egotr.exe

C:\Users\Admin\AppData\Local\Temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
"C:\Users\Admin\AppData\Local\Temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\egotr.exe
    "C:\Users\Admin\AppData\Local\Temp\egotr.exe" "-C:\Users\Admin\AppData\Local\Temp\bohxgvkbuihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:400
- - C:\Users\Admin\AppData\Local\Temp\egotr.exe
    "C:\Users\Admin\AppData\Local\Temp\egotr.exe" "-C:\Users\Admin\AppData\Local\Temp\bohxgvkbuihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:620
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe"
  2⤵
  PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bohxgvkbuihphpmz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\csohtldxtkmxsddtoog.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\egotr.exe

Filesize
700KB

MD5
0eec9c853adec2d8db508a97df6bced4

SHA1
33ebee06516f05a3a0ed8cb27571074259a9e4b0

SHA256
163eb319ef862feab37ebcb6ee1d81b69af87458eb9fbcf4549e743839103121

SHA512
49b4e35c7dd7220934d563a0ead367e57a172d249e6aa36839e2ad32c5c67590dedbedc850cecee7a3b4e849e5e54dc366da4b6a07d0a9cd3cd37e6109b208a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\egotr.exe

Filesize
700KB

MD5
0eec9c853adec2d8db508a97df6bced4

SHA1
33ebee06516f05a3a0ed8cb27571074259a9e4b0

SHA256
163eb319ef862feab37ebcb6ee1d81b69af87458eb9fbcf4549e743839103121

SHA512
49b4e35c7dd7220934d563a0ead367e57a172d249e6aa36839e2ad32c5c67590dedbedc850cecee7a3b4e849e5e54dc366da4b6a07d0a9cd3cd37e6109b208a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\egotr.exe

Filesize
700KB

MD5
0eec9c853adec2d8db508a97df6bced4

SHA1
33ebee06516f05a3a0ed8cb27571074259a9e4b0

SHA256
163eb319ef862feab37ebcb6ee1d81b69af87458eb9fbcf4549e743839103121

SHA512
49b4e35c7dd7220934d563a0ead367e57a172d249e6aa36839e2ad32c5c67590dedbedc850cecee7a3b4e849e5e54dc366da4b6a07d0a9cd3cd37e6109b208a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewupdxrnleivsfhzwyski.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\iwqhrhxpjyyhajhvo.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgdxkdwrogjvrdevrslc.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\rgbtevmfaqrbvfetnm.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\vonjytolkejxvjmfdgbutp.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
3f27f4c60d04090f1ff8dddb4c54ce82

SHA1
9a9ad067fc7fab4f56f8ddf6460803351575f7bd

SHA256
6beb9c11fbbb6fc58b23ebb611153a78ad1d42c7b2b7de23f83f8b7a1df7a4c2

SHA512
8a5b5cf2f3ccd8a930134607786559d5635b5be86a4f58270ae90ae3783f8feb40db12323dc0ee2ff5f4ed0854d71c25d9f317b0daa5c78851d4e669569965ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
3f27f4c60d04090f1ff8dddb4c54ce82

SHA1
9a9ad067fc7fab4f56f8ddf6460803351575f7bd

SHA256
6beb9c11fbbb6fc58b23ebb611153a78ad1d42c7b2b7de23f83f8b7a1df7a4c2

SHA512
8a5b5cf2f3ccd8a930134607786559d5635b5be86a4f58270ae90ae3783f8feb40db12323dc0ee2ff5f4ed0854d71c25d9f317b0daa5c78851d4e669569965ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
3f27f4c60d04090f1ff8dddb4c54ce82

SHA1
9a9ad067fc7fab4f56f8ddf6460803351575f7bd

SHA256
6beb9c11fbbb6fc58b23ebb611153a78ad1d42c7b2b7de23f83f8b7a1df7a4c2

SHA512
8a5b5cf2f3ccd8a930134607786559d5635b5be86a4f58270ae90ae3783f8feb40db12323dc0ee2ff5f4ed0854d71c25d9f317b0daa5c78851d4e669569965ee

Download Submit
C:\Windows\SysWOW64\bohxgvkbuihphpmz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\csohtldxtkmxsddtoog.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\ewupdxrnleivsfhzwyski.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\iwqhrhxpjyyhajhvo.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\pgdxkdwrogjvrdevrslc.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\rgbtevmfaqrbvfetnm.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\vonjytolkejxvjmfdgbutp.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\bohxgvkbuihphpmz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\bohxgvkbuihphpmz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\bohxgvkbuihphpmz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\csohtldxtkmxsddtoog.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\csohtldxtkmxsddtoog.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\csohtldxtkmxsddtoog.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\ewupdxrnleivsfhzwyski.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\ewupdxrnleivsfhzwyski.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\ewupdxrnleivsfhzwyski.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\iwqhrhxpjyyhajhvo.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\iwqhrhxpjyyhajhvo.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\iwqhrhxpjyyhajhvo.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\pgdxkdwrogjvrdevrslc.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\pgdxkdwrogjvrdevrslc.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\pgdxkdwrogjvrdevrslc.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\rgbtevmfaqrbvfetnm.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\rgbtevmfaqrbvfetnm.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\rgbtevmfaqrbvfetnm.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\vonjytolkejxvjmfdgbutp.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\vonjytolkejxvjmfdgbutp.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\vonjytolkejxvjmfdgbutp.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit