16c596f3db3945e0ce9aaef4b2a1e12a4ac0d6be1e1f6a1aa61cffe15d022512

Resubmissions

11-01-2022 18:54

220111-xkmdxsggc9 1

11-09-2020 18:27

200911-187b2y2jpa 10

Analysis

max time kernel
144s
max time network
142s
platform
windows7_x64
resource
win7
submitted
11-09-2020 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MyLanViewer.exe
Size

4.7MB
MD5

19f2de951583721b6fca9f2fe0f03805
SHA1

adcd8b173ecee8b4f47bf8e60047e8491dab243e
SHA256

16c596f3db3945e0ce9aaef4b2a1e12a4ac0d6be1e1f6a1aa61cffe15d022512
SHA512

941dc498b977176e64af94061e2cd2aa958d583505600f318c3746430190794ea39b0f06708b8ad94dd049cdafe7f6ff317b831df38d1ae93da51db624812294

Score

10^/10

persistence stealer adware discovery

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Executes dropped EXE 5 IoCs

Processes:

Adobe_Updater.exeuninstaller.exeUn_A.exedefault-browser-agent.exeUn_B.exe

pid process

584 Adobe_Updater.exe
540 uninstaller.exe
1988 Un_A.exe
1080 default-browser-agent.exe
1964 Un_B.exe

pid	process
584	Adobe_Updater.exe
540	uninstaller.exe
1988	Un_A.exe
1080	default-browser-agent.exe
1964	Un_B.exe

Loads dropped DLL 55 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exehelper.exeuninstaller.exeUn_A.exeregsvr32.exeuninstall.exeUn_B.exe

pid	process
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
1772	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1964	helper.exe
1964	helper.exe
1964	helper.exe
1964	helper.exe
540	uninstaller.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
1988	Un_A.exe
884	regsvr32.exe
1988	Un_A.exe
1988	Un_A.exe
1652	uninstall.exe
1964	Un_B.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll	js

Drops file in System32 directory 1 IoCs

Processes:

MsiExec.exe

description ioc process

File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Modifies service 2 TTPs 149 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exemsiexec.exeUn_A.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Enter) = 480000000000000000d622f86988d601d0070000dc070000020400000100000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Leave) = 4800000000000000e04b26f96988d601d0070000dc070000020400000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Enter) = 4800000000000000808543f36988d601d00700005c070000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Enter) = 4800000000000000200d06fa6988d601d0070000dc070000ff0300000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Enter) = 4800000000000000802c96f96988d601d0070000dc070000ee0300000100000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{a2da1a04-afea-11ea-ab7e-806e6f6e6963}_)\IOCTL_FLUSH_AND_HOLD (Leave) = 4800000000000000c0ab03fa6988d601d0070000c4010000fe0300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 4800000000000000e0cf0afa6988d601a4050000e0030000d50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Leave) = 4800000000000000a0a835fa6988d601d007000074070000fc0300000000000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 480000000000000060e755f96988d601d0070000ec020000020000000100000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Enter) = 4800000000000000e09bf5f76988d601a4050000a4070000e90300000100000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Leave) = 4800000000000000003684fa6988d601d007000018040000f50300000000000004000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Enter) = 4800000000000000808543f36988d601d007000080070000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Leave) = 4800000000000000803af3f76988d601d0070000f4070000010400000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Leave) = 4800000000000000a0690df86988d601d00700005c070000e90300000000000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Enter) = 480000000000000000a78cf96988d601d007000078040000fc0300000100000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Leave) = 4800000000000000802c96f96988d601d0070000dc070000ed0300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\BKGND_FREEZE_THREAD (Enter) = 48000000000000008058e2f96988d601d00700008c070000fc0300000100000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Enter) = 4800000000000000808543f36988d601d007000084030000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\GETSTATE (Leave) = 4800000000000000805019f86988d601a405000074060000f90300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Enter) = 4800000000000000c096f2f26988d601a4050000e0030000d00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppGatherWriterMetadata (Enter) = 480000000000000060613cf36988d601a4050000e0030000d30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppAddInterestingComponents (Leave) = 4800000000000000c06cdbf76988d601a4050000e0030000d40700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Enter) = 48000000000000004026faf96988d601d0070000dc070000fe0300000100000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Leave) = 4800000000000000200d06fa6988d601d0070000dc070000050400000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Enter) = 4800000000000000a0a835fa6988d601d0070000dc070000060400000100000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_STABLE (SetCurrentState) = 480000000000000000c0fcf76988d601d007000080070000010000000100000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPARESNAPSHOT (Enter) = 480000000000000080f536f96988d601d0070000ec020000ea0300000100000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 4800000000000000a0a94af36988d601d007000080070000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\AppId_Catalog\1F97E3EE	Un_A.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 4800000000000000c03d45f96988d601d007000060030000020000000100000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 480000000000000000b29ff96988d601d007000074070000fc0300000100000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 4800000000000000a0a835fa6988d601d007000044020000040000000100000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\POSTSNAPSHOT (Enter) = 4800000000000000c0ed75fa6988d601d0070000ec020000f50300000100000004000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Leave) = 4800000000000000e053effa6988d601d0070000dc070000fb0300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Leave) = 4800000000000000404848f36988d601d00700005c070000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_STABLE (SetCurrentState) = 48000000000000006021fff76988d601d0070000f4070000010000000100000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Leave) = 4800000000000000602c12f86988d601a4050000a4070000e90300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\FREEZE (Enter) = 480000000000000020e1b9f96988d601d007000018040000eb0300000100000002000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_RM (Leave) = 48000000000000008058e2f96988d601d0070000dc070000ef0300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Leave) = 4800000000000000200d06fa6988d601d0070000dc070000ff0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000003684fa6988d601d007000018040000050000000100000004000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppAddInterestingComponents (Enter) = 48000000000000006000c6f76988d601a4050000e0030000d40700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Leave) = 480000000000000000c0fcf76988d601d007000080070000e90300000000000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Leave) = 4800000000000000a0a835fa6988d601d007000044020000f20300000000000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\GETSTATE (Leave) = 4800000000000000805019f86988d601d00700005c070000f90300000000000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE (Leave) = 48000000000000008058e2f96988d601d0070000dc070000eb0300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Enter) = 4800000000000000c0ed75fa6988d601d007000018040000f50300000100000004000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000c0ed75fa6988d601d0070000ec020000050000000100000004000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Enter) = 4800000000000000a05efaf76988d601d007000080070000e90300000100000001000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\DOSNAPSHOT (Leave) = 4800000000000000806e08fa6988d601a4050000a00700000a0400000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Enter) = 480000000000000000a78cf96988d601d0070000dc070000ed0300000100000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 480000000000000000b29ff96988d601d007000018040000030000000100000002000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{a2da1a04-afea-11ea-ab7e-806e6f6e6963}_)\IOCTL_RELEASE (Leave) = 4800000000000000200d06fa6988d601d0070000c4010000ff0300000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Leave) = 4800000000000000200d06fa6988d601d00700004c020000040400000000000000000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Enter) = 4800000000000000a0a835fa6988d601d007000048050000f20300000100000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Enter) = 4800000000000000a0a835fa6988d601d007000044020000f20300000100000003000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Enter) = 480000000000000000a78cf96988d601d007000044020000eb0300000100000002000000000000004c132018bbc13a4e9bd51b0383fd958000000000000000000000000000000000	vssvc.exe

Drops file in Program Files directory 413 IoCs

Processes:

Un_A.exemsiexec.exeUn_B.exehelper.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi	Un_A.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\tobedeleted\nsiFDA5.tmp	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.ini	Un_A.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\tobedeleted\nsoFDCD.tmp	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api	msiexec.exe
File created	C:\Program Files\Mozilla Firefox\nsdF3C3.tmp\pingsender.exe	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Data1.cab	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer	msiexec.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsdF3C3.tmp\nssckbi.dll	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\application.ini	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api	msiexec.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\osclientcerts.dll	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\msvcp140.dll	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Un_A.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log.moz-delete	Un_B.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	Un_A.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe	helper.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Un_A.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf	msiexec.exe

Drops file in Windows directory 48 IoCs

Processes:

msiexec.exeDrvInst.exeSetup.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SecStoreFile.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6097.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB3DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB834.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC98B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f755deb.ipi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	Setup.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIAF38.tmp	msiexec.exe
File created	C:\Windows\Installer\f755deb.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcr80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB70B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcp80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID93C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID97B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB43B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID464.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID59E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB45B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcm80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\RMFFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\f755dda.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f755dda.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB013.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBB0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\FDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFile_8.ico	msiexec.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeAdobe AIR Updater.exeadobe air updater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Adobe AIR Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Adobe AIR Updater.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	adobe air updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	adobe air updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08E8D305-8D6D-49fe-8603-03A926E46AE0}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}	msiexec.exe

Modifies data under HKEY_USERS 109 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Disk Defragmenter"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\WindowsAnytimeUpgradeUI.exe,-1 = "Windows Anytime Upgrade"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320 = "Connect to a Projector"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe,-291 = "Math Input Panel"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588 = "Windows Easy Transfer"	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403 = "Windows DVD Maker"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\TipTsf.dll,-80 = "Tablet PC Input Panel"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10 = "Ease of Access Center"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501 = "Connect to a Network Projector"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101 = "Windows PowerShell ISE"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008 = "Windows Mobility Center"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005 = "Desktop Gadget Gallery"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056 = "Getting Started"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000 = "Sync Center"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\gameux.dll,-10082 = "Games Explorer"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\wucltux.dll,-1 = "Windows Update"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\ehome\ehres.dll,-100 = "Windows Media Center"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe

Modifies registry class 704 IoCs

Processes:

msiexec.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E64169B3-3592-47d2-816E-602C5C13F328}\1.1\HELPDIR	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.AcroAXDoc.1\Shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\Insertable	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Print\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelper.AcroIEHlprObj.1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\Programmable	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67E94227-7662-4050-9C72-746983CF37A2}\1.0\FLAGS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\3	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelper.AcroIEHlprObj	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\protocol\StdFileEditing\verb	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3F1-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DF9A1DA0-23C0-101B-B02E-FDFDFDFDFDFD}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5BB2200E-5672-4A32-902A-5A98DB1C58DC}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F226421-415D-408D-9A09-0DCD94E25B48}\1.0\0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{36DE898D-AD48-40A5-B4B2-123F916BFBAB}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ColumnHandlers	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\FLAGS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32983FF-EF84-4945-8F86-FB7491B4F57B}\NUMMETHODS	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCA8D857-1A63-4045-8F36-8809EB093D04}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67E94227-7662-4050-9C72-746983CF37A2}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE30F77E-8847-44F0-A648-A9656BD89C0D}\ASYNCHRONOUSINTERFACE	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CD06992-50AA-11D1-B8F0-00A0C9259304}\1.0\0\win32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BBAA0E44-3862-490C-8E63-AC2D2D6EF733}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Control	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F2383816-917A-46CC-AD2A-5013BED3800F}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7CD069A0-50AA-11D1-B8F0-00A0C9259304}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EF-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.air	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\IA3DServer.FontManager\CurVer	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{673E8452-7646-11D1-B90B-00A0C9259304}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF}\1.0\0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{198F17AE-B921-4308-9543-288D426A5C2B}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\IA3DServer.FontManager	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2DEA7885-1846-411F-A41E-017A8FD778FF}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2DEA7885-1846-411F-A41E-017A8FD778FF}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EF-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFShellServer.PDFShellInfo	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\protocol\StdFileEditing\RequestDataFormats	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\shell\Read	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\AcrobatVersion	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3ED-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8215BA54-B69F-4275-AE11-31CB63593B09}\ProxyStubClsid32	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeSetup.exe

pid	process
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1444	msiexec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
956	MsiExec.exe
956	MsiExec.exe
1336	Setup.exe
1336	Setup.exe
1336	Setup.exe
1336	Setup.exe
1336	Setup.exe
1336	Setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2008 rundll32.exe

pid	process
2008	rundll32.exe

Suspicious use of AdjustPrivilegeToken 779 IoCs

Processes:

7zG.exerundll32.exeAUDIODG.EXEadobe air updater.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	1644	7zG.exe
Token: 35	1644	7zG.exe
Token: SeSecurityPrivilege	1644	7zG.exe
Token: SeSecurityPrivilege	1644	7zG.exe
Token: SeShutdownPrivilege	2008	rundll32.exe
Token: SeShutdownPrivilege	2008	rundll32.exe
Token: 33	392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	392	AUDIODG.EXE
Token: 33	392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	392	AUDIODG.EXE
Token: SeShutdownPrivilege	1840	adobe air updater.exe
Token: SeIncreaseQuotaPrivilege	1840	adobe air updater.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeSecurityPrivilege	1444	msiexec.exe
Token: SeCreateTokenPrivilege	1840	adobe air updater.exe
Token: SeAssignPrimaryTokenPrivilege	1840	adobe air updater.exe
Token: SeLockMemoryPrivilege	1840	adobe air updater.exe
Token: SeIncreaseQuotaPrivilege	1840	adobe air updater.exe
Token: SeMachineAccountPrivilege	1840	adobe air updater.exe
Token: SeTcbPrivilege	1840	adobe air updater.exe
Token: SeSecurityPrivilege	1840	adobe air updater.exe
Token: SeTakeOwnershipPrivilege	1840	adobe air updater.exe
Token: SeLoadDriverPrivilege	1840	adobe air updater.exe
Token: SeSystemProfilePrivilege	1840	adobe air updater.exe
Token: SeSystemtimePrivilege	1840	adobe air updater.exe
Token: SeProfSingleProcessPrivilege	1840	adobe air updater.exe
Token: SeIncBasePriorityPrivilege	1840	adobe air updater.exe
Token: SeCreatePagefilePrivilege	1840	adobe air updater.exe
Token: SeCreatePermanentPrivilege	1840	adobe air updater.exe
Token: SeBackupPrivilege	1840	adobe air updater.exe
Token: SeRestorePrivilege	1840	adobe air updater.exe
Token: SeShutdownPrivilege	1840	adobe air updater.exe
Token: SeDebugPrivilege	1840	adobe air updater.exe
Token: SeAuditPrivilege	1840	adobe air updater.exe
Token: SeSystemEnvironmentPrivilege	1840	adobe air updater.exe
Token: SeChangeNotifyPrivilege	1840	adobe air updater.exe
Token: SeRemoteShutdownPrivilege	1840	adobe air updater.exe
Token: SeUndockPrivilege	1840	adobe air updater.exe
Token: SeSyncAgentPrivilege	1840	adobe air updater.exe
Token: SeEnableDelegationPrivilege	1840	adobe air updater.exe
Token: SeManageVolumePrivilege	1840	adobe air updater.exe
Token: SeImpersonatePrivilege	1840	adobe air updater.exe
Token: SeCreateGlobalPrivilege	1840	adobe air updater.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

1644 7zG.exe

pid	process
1644	7zG.exe

Suspicious use of WriteProcessMemory 89 IoCs

Processes:

DllHost.exeAdobe AIR Updater.exemsiexec.exeMsiExec.exehelper.exeuninstaller.exeUn_A.exe

description	pid	process	target process
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1520 wrote to memory of 1608	1520	DllHost.exe	Adobe AIR Updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1608 wrote to memory of 1840	1608	Adobe AIR Updater.exe	adobe air updater.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1844	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 956	1444	msiexec.exe	MsiExec.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 956 wrote to memory of 584	956	MsiExec.exe	Adobe_Updater.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1772	1444	msiexec.exe	MsiExec.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 1964 wrote to memory of 540	1964	helper.exe	uninstaller.exe
PID 540 wrote to memory of 1988	540	uninstaller.exe	Un_A.exe
PID 540 wrote to memory of 1988	540	uninstaller.exe	Un_A.exe
PID 540 wrote to memory of 1988	540	uninstaller.exe	Un_A.exe
PID 540 wrote to memory of 1988	540	uninstaller.exe	Un_A.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 884	1988	Un_A.exe	regsvr32.exe
PID 1988 wrote to memory of 1080	1988	Un_A.exe	default-browser-agent.exe
PID 1988 wrote to memory of 1080	1988	Un_A.exe	default-browser-agent.exe
PID 1988 wrote to memory of 1080	1988	Un_A.exe	default-browser-agent.exe
PID 1988 wrote to memory of 1080	1988	Un_A.exe	default-browser-agent.exe

C:\Users\Admin\AppData\Local\Temp\MyLanViewer.exe
"C:\Users\Admin\AppData\Local\Temp\MyLanViewer.exe"
1⤵
PID:1012

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\DenyResize\" -ad -an -ai#7zMap10425:82:7zEvent10430
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1644

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1908

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL PowerCfg.cpl @0,/editplan:8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:592

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:676

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe" -arp:uninstall
2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1608

C:\program files (x86)\common files\adobe air\versions\1.0\adobe air updater.exe
"C:\program files (x86)\common files\adobe air\versions\1.0\adobe air updater.exe" -stdio \\.\pipe\AIR_1608_0 -uninstall
3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies service
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 33DC32A8030FD4272947B6B231F1638E
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A5E9DF81D949A77DCF24C26EDEA186AD M Global\MSI0000
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956

C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
"C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=5
3⤵
- Executes dropped EXE
PID:584

C:\Windows\syswow64\MsiExec.exe
"C:\Windows\syswow64\MsiExec.exe" /Z "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll"
2⤵
- Loads dropped DLL
PID:1772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
PID:2000

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005A4" "00000000000005A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1968

C:\Program Files\Mozilla Firefox\uninstall\helper.exe
"C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1964

C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe
"C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\Mozilla Firefox\uninstall\
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies service
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:884

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" unregister-task 308046B0AF4A39CB
4⤵
- Executes dropped EXE
PID:1080

C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe" /S
4⤵
- Loads dropped DLL
PID:1652

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe" /S _?=C:\Program Files (x86)\Mozilla Maintenance Service\
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall
6⤵
PID:828

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\\Setup.exe" /repair /x86 /x64
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1336

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
SetupUtility.exe /screboot
2⤵
PID:860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log

Download Submit
C:\Program Files\Mozilla Firefox\AccessibleHandler.dll

Download Submit
C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download Submit
C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe

Download Submit
C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Download Submit
C:\Windows\Installer\MSIAD62.tmp

Download Submit
C:\Windows\Installer\MSIAEF9.tmp

Download Submit
C:\Windows\Installer\MSIAF38.tmp

Download Submit
C:\Windows\Installer\MSIB013.tmp

Download Submit
C:\Windows\Installer\MSIB3DC.tmp

Download Submit
C:\Windows\Installer\MSIB3FC.tmp

Download Submit
C:\Windows\Installer\MSIB43B.tmp

Download Submit
C:\Windows\Installer\MSIB45B.tmp

Download Submit
C:\Windows\Installer\MSIB70B.tmp

Download Submit
C:\Windows\Installer\MSIBA57.tmp

Download Submit
C:\Windows\Installer\MSIBBB0.tmp

Download Submit
C:\Windows\Installer\MSIBC8C.tmp

Download Submit
C:\Windows\Installer\MSIBE03.tmp

Download Submit
C:\Windows\Installer\MSIBEEE.tmp

Download Submit
C:\Windows\Installer\MSIBF3D.tmp

Download Submit
C:\Windows\Installer\MSIC98B.tmp

Download Submit
C:\Windows\Installer\MSID464.tmp

Download Submit
C:\Windows\Installer\MSID4A4.tmp

Download Submit
C:\Windows\Installer\MSID59E.tmp

Download Submit
C:\Windows\Installer\MSID5DE.tmp

Download Submit
C:\Windows\Installer\MSID6B9.tmp

Download Submit
C:\Windows\Installer\MSID6E9.tmp

Download Submit
C:\Windows\Installer\MSID93C.tmp

Download Submit
C:\Windows\Installer\MSID97B.tmp

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api

Download Submit
\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe

Download Submit
\Program Files\Mozilla Firefox\AccessibleHandler.dll

Download Submit
\Program Files\Mozilla Firefox\uninstall\uninstaller.exe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ApplicationID.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\Banner.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\BitsUtils.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\CityHash.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\InstallOptions.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\InstallOptions.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ServicesHelper.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoECFF.tmp\nsExec.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoFF95.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEB1B.tmp\CityHash.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEB1B.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEB1B.tmp\UAC.dll

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Download Submit
\Windows\Installer\MSIAD62.tmp

Download Submit
\Windows\Installer\MSIAEF9.tmp

Download Submit
\Windows\Installer\MSIAF38.tmp

Download Submit
\Windows\Installer\MSIB013.tmp

Download Submit
\Windows\Installer\MSIB3DC.tmp

Download Submit
\Windows\Installer\MSIB3FC.tmp

Download Submit
\Windows\Installer\MSIB43B.tmp

Download Submit
\Windows\Installer\MSIB45B.tmp

Download Submit
\Windows\Installer\MSIB70B.tmp

Download Submit
\Windows\Installer\MSIBA57.tmp

Download Submit
\Windows\Installer\MSIBBB0.tmp

Download Submit
\Windows\Installer\MSIBC8C.tmp

Download Submit
\Windows\Installer\MSIBE03.tmp

Download Submit
\Windows\Installer\MSIBEEE.tmp

Download Submit
\Windows\Installer\MSIBF3D.tmp

Download Submit
\Windows\Installer\MSIC98B.tmp

Download Submit
\Windows\Installer\MSID464.tmp

Download Submit
\Windows\Installer\MSID4A4.tmp

Download Submit
\Windows\Installer\MSID59E.tmp

Download Submit
\Windows\Installer\MSID5DE.tmp

Download Submit
\Windows\Installer\MSID6B9.tmp

Download Submit
\Windows\Installer\MSID6E9.tmp

Download Submit
\Windows\Installer\MSID93C.tmp

Download Submit
\Windows\Installer\MSID97B.tmp

Download Submit
memory/540-184-0x0000000000000000-mapping.dmp

Download
memory/584-93-0x0000000000000000-mapping.dmp

Download
memory/828-226-0x0000000000000000-mapping.dmp

Download
memory/860-234-0x0000000000000000-mapping.dmp

Download
memory/884-210-0x0000000000000000-mapping.dmp

Download
memory/956-85-0x0000000000000000-mapping.dmp

Download
memory/1080-213-0x0000000000000000-mapping.dmp

Download
memory/1336-230-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/1336-231-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/1336-232-0x0000000000340000-0x0000000000342000-memory.dmp

Filesize
8KB

Download
memory/1444-77-0x00000000026D0000-0x00000000026D4000-memory.dmp

Filesize
16KB

Download
memory/1444-116-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-152-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-154-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-155-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-156-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-157-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-150-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1444-149-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-148-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-147-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-145-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-144-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-143-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1444-141-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-139-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-137-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-136-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-135-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-170-0x0000000004AE0000-0x0000000004AE4000-memory.dmp

Filesize
16KB

Download
memory/1444-171-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1444-134-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-133-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-132-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-130-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-177-0x0000000004AE0000-0x0000000004AE4000-memory.dmp

Filesize
16KB

Download
memory/1444-178-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-129-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-128-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1444-127-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-126-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-125-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-124-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-122-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-121-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-120-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-119-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-118-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1444-117-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-151-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-114-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1444-101-0x0000000004AE0000-0x0000000004AE4000-memory.dmp

Filesize
16KB

Download
memory/1444-79-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-78-0x0000000002060000-0x0000000002064000-memory.dmp

Filesize
16KB

Download
memory/1444-47-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-25-0x00000000013E0000-0x00000000013E4000-memory.dmp

Filesize
16KB

Download
memory/1444-26-0x0000000000EF0000-0x0000000000EF4000-memory.dmp

Filesize
16KB

Download
memory/1444-27-0x0000000001D10000-0x0000000001D14000-memory.dmp

Filesize
16KB

Download
memory/1444-41-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-40-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-37-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-35-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-32-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1444-31-0x0000000001D10000-0x0000000001D14000-memory.dmp

Filesize
16KB

Download
memory/1444-30-0x0000000001D10000-0x0000000001D14000-memory.dmp

Filesize
16KB

Download
memory/1444-29-0x0000000000EF0000-0x0000000000EF4000-memory.dmp

Filesize
16KB

Download
memory/1608-9-0x00000000074F1000-0x00000000074F5000-memory.dmp

Filesize
16KB

Download
memory/1608-0-0x0000000000000000-mapping.dmp

Download
memory/1608-10-0x00000000074FB000-0x00000000074FF000-memory.dmp

Filesize
16KB

Download
memory/1608-7-0x000000000723C000-0x0000000007240000-memory.dmp

Filesize
16KB

Download
memory/1608-8-0x00000000074BF000-0x00000000074C3000-memory.dmp

Filesize
16KB

Download
memory/1652-220-0x0000000000000000-mapping.dmp

Download
memory/1772-107-0x0000000000000000-mapping.dmp

Download
memory/1840-23-0x0000000005A02000-0x0000000005A06000-memory.dmp

Filesize
16KB

Download
memory/1840-24-0x0000000007968000-0x000000000796C000-memory.dmp

Filesize
16KB

Download
memory/1840-22-0x000000000793E000-0x0000000007942000-memory.dmp

Filesize
16KB

Download
memory/1840-21-0x000000000722F000-0x0000000007233000-memory.dmp

Filesize
16KB

Download
memory/1840-20-0x0000000005E05000-0x0000000005E09000-memory.dmp

Filesize
16KB

Download
memory/1840-19-0x0000000007904000-0x0000000007908000-memory.dmp

Filesize
16KB

Download
memory/1840-16-0x0000000007540000-0x0000000007544000-memory.dmp

Filesize
16KB

Download
memory/1840-11-0x0000000000000000-mapping.dmp

Download
memory/1844-42-0x0000000000000000-mapping.dmp

Download
memory/1964-222-0x0000000000000000-mapping.dmp

Download
memory/1988-229-0x0000000002A10000-0x0000000002A14000-memory.dmp

Filesize
16KB

Download
memory/1988-228-0x0000000002E10000-0x0000000002E14000-memory.dmp

Filesize
16KB

Download
memory/1988-217-0x0000000003B90000-0x0000000003C91000-memory.dmp

Filesize
1.0MB

Download
memory/1988-193-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1988-188-0x0000000000000000-mapping.dmp

Download