01469064718c89b6853365f1c7008c72ccd6a1ecb88a52cfcf82880e39dd0358

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
08-04-2021 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e949d5238fbf2ade45c91bb54de22ea.exe
Size

590KB
MD5

1e949d5238fbf2ade45c91bb54de22ea
SHA1

2e72856da91bde014732628119407d637c97a283
SHA256

01469064718c89b6853365f1c7008c72ccd6a1ecb88a52cfcf82880e39dd0358
SHA512

253007a3c0071e7a16e554ef7beb54b7e4875503e0074886793e34d9c3a77f00f744659755f5ea48187697006e3e6f0482bc3d5f1276ccef17433685a57ea236

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

Processes:

updachrome.exeupdachrome.exeservs.exeservs.tmpPasswordOnWakeSettingFlyout.exepass.exepass.tmpCertMgr.Exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	process
3948	updachrome.exe
3648	updachrome.exe
4088	servs.exe
2612	servs.tmp
1096	PasswordOnWakeSettingFlyout.exe
1200	pass.exe
2672	pass.tmp
4236	CertMgr.Exe
4316	rutserv.exe
4488	rutserv.exe
4716	rutserv.exe
4900	rutserv.exe
2188	rfusclient.exe
4104	rfusclient.exe
3780	rfusclient.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rfusclient.exeupdachrome.exerutserv.exerutserv.exerutserv.exerfusclient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	updachrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Loads dropped DLL 9 IoCs

Processes:

PasswordOnWakeSettingFlyout.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
1096	PasswordOnWakeSettingFlyout.exe
4316	rutserv.exe
4316	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

updachrome.exe

description pid process target process

PID 3948 set thread context of 3648 3948 updachrome.exe updachrome.exe
Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3948 set thread context of 3648	3948	updachrome.exe	updachrome.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rutserv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\16	rutserv.exe
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\1	rutserv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rutserv.exe
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\2	rutserv.exe
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\0	rutserv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rutserv.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3460 timeout.exe

pid	process
3460	timeout.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

rutserv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 04d76ef7542cd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{83171DCD-1AE6-402E-996B-C5879EB86E29}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000031f2938431cc52952bfafaa22a3c44b04112d3c3f5bb56fce63aeb480a4abf519878beb8fad8bed7d5f373b555a110cc5c4aa2685108d2023cdd	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 998267c856add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

1e949d5238fbf2ade45c91bb54de22ea.exeCertMgr.Exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	1e949d5238fbf2ade45c91bb54de22ea.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	1e949d5238fbf2ade45c91bb54de22ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927	CertMgr.Exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5E2169F36E05D5652FF097A43315EECA06FC5927\Blob = 0300000001000000140000005e2169f36e05d5652ff097a43315eeca06fc59272000000001000000350400003082043130820319a0030201020208246fe7e5239f00ab300d06092a864886f70d01010b05003067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d65301e170d3231303131343030303030305a170d3236303131343030303030305a3067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d6530820122300d06092a864886f70d01010105000382010f003082010a0282010100d1a9b26fb967ceeaf721405b88d92128d52c164c8d30c5502ffb7096304ae932c4f392cabadf2fb93121587a81da39f96f903bb71992e3432e8cec73e8ae262c029bf31f8309cfb5bd156a10910fcf52d3719fb00c35c2f6f2b9ea57c3e4c9e03a504081638214abbfaf88b0f2cb4c3d917c36178017ead5fee5ba28f6ed1b5c949924cdd1d91ea25e77d2293b18a0ff95d3ea1a37a6caa57a1b441deda7adfb1d4779e43ce7c6eb8ca670a3bbac3cddea948656929c86b01af54efc4fd48637d8d20b046589fadf780babe9a9638cd1f47bd42a0acd379c9cdd512487ea1c21d51598ea090acb5da4d09eb01eff0c99bba888a24a049690a8838cff86fe9e7d0203010001a381e03081dd3081980603551d2304819030818d80141b6be17c5727085080af0cd9e4522109e6704d75a16ba4693067310b30090603550406130252553113301106035504070c0a53746164747265636874310e300c060355040a0c0554756e65723121301f06092a864886f70d010901161261646d696e4065616d617269616e2e636f6d3110300e06035504030c0765587472656d658208246fe7e5239f00ab301d0603551d0e041604141b6be17c5727085080af0cd9e4522109e6704d75300c0603551d130101ff0402300030130603551d25040c300a06082b06010505070303300d06092a864886f70d01010b050003820101001ebd2ee6d64d3898015e825e1e53ee841938a5eb5162904448f2f07af5095fcd7f0f87ebd15f66f81dad1a72f924e05a7178909fd64ae08f1ae4e544a76cb367701525561bb27e4047fbec5382106aa626b3b49e4444b5dea2150263413fe76ac7425bc6aac52d523d713b3b4c43b0113088ced94c1bd245879ce05241255c0ff84ebf0f78fd41ff95c47cef4bf7b203f92a15c709c4a446a8ab19caa8f62381227ee62baf02539a087f93b6851d4291005e739e7370b887501506519838bc2f86c7c409ebb5901cb34b1f6a92eace94450ed94cddb077e34074234059aed1871300ae58f72320f0770d2ad6de8a1b5442fe9bbcb8d108fc5b5389dc14865dd8	CertMgr.Exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

4128 regedit.exe

pid	process
4128	regedit.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

updachrome.exeservs.tmppass.tmprutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	process
3648	updachrome.exe
2612	servs.tmp
2612	servs.tmp
2672	pass.tmp
2672	pass.tmp
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4104	rfusclient.exe
4104	rfusclient.exe
2188	rfusclient.exe
2188	rfusclient.exe
4104	rfusclient.exe
4104	rfusclient.exe
2188	rfusclient.exe
2188	rfusclient.exe
3780	rfusclient.exe
3780	rfusclient.exe
3780	rfusclient.exe
3780	rfusclient.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

3472 MicrosoftEdgeCP.exe

pid	process
3472	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

updachrome.exeMicrosoftEdge.exeMicrosoftEdgeCP.exerutserv.exerutserv.exerutserv.exe

description	pid	process
Token: SeDebugPrivilege	3648	updachrome.exe
Token: SeDebugPrivilege	1264	MicrosoftEdge.exe
Token: SeDebugPrivilege	1264	MicrosoftEdge.exe
Token: SeDebugPrivilege	1264	MicrosoftEdge.exe
Token: SeDebugPrivilege	1264	MicrosoftEdge.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3540	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4316	rutserv.exe
Token: SeDebugPrivilege	4716	rutserv.exe
Token: SeTakeOwnershipPrivilege	4900	rutserv.exe
Token: SeTcbPrivilege	4900	rutserv.exe
Token: SeTcbPrivilege	4900	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

servs.tmppass.tmp

pid process

2612 servs.tmp
2672 pass.tmp

pid	process
2612	servs.tmp
2672	pass.tmp

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid	process
1264	MicrosoftEdge.exe
3472	MicrosoftEdgeCP.exe
3472	MicrosoftEdgeCP.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4316	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4716	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe
4900	rutserv.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

1e949d5238fbf2ade45c91bb54de22ea.exeupdachrome.exeupdachrome.exeservs.exeservs.tmpcmd.exePasswordOnWakeSettingFlyout.exepass.exepass.tmpcmd.execmd.exerutserv.exerfusclient.exe

description	pid	process	target process
PID 3576 wrote to memory of 3948	3576	1e949d5238fbf2ade45c91bb54de22ea.exe	updachrome.exe
PID 3576 wrote to memory of 3948	3576	1e949d5238fbf2ade45c91bb54de22ea.exe	updachrome.exe
PID 3576 wrote to memory of 3948	3576	1e949d5238fbf2ade45c91bb54de22ea.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3948 wrote to memory of 3648	3948	updachrome.exe	updachrome.exe
PID 3648 wrote to memory of 4088	3648	updachrome.exe	servs.exe
PID 3648 wrote to memory of 4088	3648	updachrome.exe	servs.exe
PID 3648 wrote to memory of 4088	3648	updachrome.exe	servs.exe
PID 4088 wrote to memory of 2612	4088	servs.exe	servs.tmp
PID 4088 wrote to memory of 2612	4088	servs.exe	servs.tmp
PID 4088 wrote to memory of 2612	4088	servs.exe	servs.tmp
PID 2612 wrote to memory of 1652	2612	servs.tmp	cmd.exe
PID 2612 wrote to memory of 1652	2612	servs.tmp	cmd.exe
PID 1652 wrote to memory of 1096	1652	cmd.exe	PasswordOnWakeSettingFlyout.exe
PID 1652 wrote to memory of 1096	1652	cmd.exe	PasswordOnWakeSettingFlyout.exe
PID 1096 wrote to memory of 1200	1096	PasswordOnWakeSettingFlyout.exe	pass.exe
PID 1096 wrote to memory of 1200	1096	PasswordOnWakeSettingFlyout.exe	pass.exe
PID 1096 wrote to memory of 1200	1096	PasswordOnWakeSettingFlyout.exe	pass.exe
PID 1200 wrote to memory of 2672	1200	pass.exe	pass.tmp
PID 1200 wrote to memory of 2672	1200	pass.exe	pass.tmp
PID 1200 wrote to memory of 2672	1200	pass.exe	pass.tmp
PID 1652 wrote to memory of 3460	1652	cmd.exe	timeout.exe
PID 1652 wrote to memory of 3460	1652	cmd.exe	timeout.exe
PID 2672 wrote to memory of 1996	2672	pass.tmp	cmd.exe
PID 2672 wrote to memory of 1996	2672	pass.tmp	cmd.exe
PID 1996 wrote to memory of 4128	1996	cmd.exe	regedit.exe
PID 1996 wrote to memory of 4128	1996	cmd.exe	regedit.exe
PID 2672 wrote to memory of 4172	2672	pass.tmp	cmd.exe
PID 2672 wrote to memory of 4172	2672	pass.tmp	cmd.exe
PID 4172 wrote to memory of 4236	4172	cmd.exe	CertMgr.Exe
PID 4172 wrote to memory of 4236	4172	cmd.exe	CertMgr.Exe
PID 4172 wrote to memory of 4236	4172	cmd.exe	CertMgr.Exe
PID 4172 wrote to memory of 4316	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4316	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4316	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4488	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4488	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4488	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4716	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4716	4172	cmd.exe	rutserv.exe
PID 4172 wrote to memory of 4716	4172	cmd.exe	rutserv.exe
PID 4900 wrote to memory of 2188	4900	rutserv.exe	rfusclient.exe
PID 4900 wrote to memory of 2188	4900	rutserv.exe	rfusclient.exe
PID 4900 wrote to memory of 2188	4900	rutserv.exe	rfusclient.exe
PID 4900 wrote to memory of 4104	4900	rutserv.exe	rfusclient.exe
PID 4900 wrote to memory of 4104	4900	rutserv.exe	rfusclient.exe
PID 4900 wrote to memory of 4104	4900	rutserv.exe	rfusclient.exe
PID 2188 wrote to memory of 3780	2188	rfusclient.exe	rfusclient.exe
PID 2188 wrote to memory of 3780	2188	rfusclient.exe	rfusclient.exe
PID 2188 wrote to memory of 3780	2188	rfusclient.exe	rfusclient.exe

C:\Users\Admin\AppData\Local\Temp\1e949d5238fbf2ade45c91bb54de22ea.exe
"C:\Users\Admin\AppData\Local\Temp\1e949d5238fbf2ade45c91bb54de22ea.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Roaming\updachrome.exe
C:\Users\Admin\AppData\Roaming\updachrome.exe updachrome
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948

C:\Users\Admin\AppData\Roaming\updachrome.exe
"{path}"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648

C:\Users\Admin\AppData\Local\Temp\servs.exe
"C:\Users\Admin\AppData\Local\Temp\servs.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\is-41VNL.tmp\servs.tmp
"C:\Users\Admin\AppData\Local\Temp\is-41VNL.tmp\servs.tmp" /SL5="$60048,10541093,724480,C:\Users\Admin\AppData\Local\Temp\servs.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\uacwev.bat""
6⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows \System32\PasswordOnWakeSettingFlyout.exe
"C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096

C:\ProgramData\pass.exe
C:\ProgramData\pass.exe
8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\is-PSQEH.tmp\pass.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PSQEH.tmp\pass.tmp" /SL5="$1028A,9506241,724480,C:\ProgramData\pass.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "regedit /s C:\ProgramData\Immunity\ses.reg"
10⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\regedit.exe
regedit /s C:\ProgramData\Immunity\ses.reg
11⤵
- Runs .reg file with regedit
PID:4128

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\Immunity\install.cmd""
10⤵
- Suspicious use of WriteProcessMemory
PID:4172

C:\ProgramData\Immunity\CertMgry\CertMgr.Exe
certmgr.exe -add -c Sert.cer -s -r localMachine Root
11⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4236

C:\ProgramData\Immunity\rutserv.exe
"rutserv.exe" /silentinstall
11⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4316

C:\ProgramData\Immunity\rutserv.exe
"rutserv.exe" /firewall
11⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4488

C:\ProgramData\Immunity\rutserv.exe
"rutserv.exe" /start
11⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Windows\system32\timeout.exe
TIMEOUT /T 8
7⤵
- Delays execution with timeout.exe
PID:3460

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1264

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\ProgramData\Immunity\rutserv.exe
"C:\ProgramData\Immunity\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900

C:\ProgramData\Immunity\rfusclient.exe
C:\ProgramData\Immunity\rfusclient.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4104

C:\ProgramData\Immunity\rfusclient.exe
C:\ProgramData\Immunity\rfusclient.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188

C:\ProgramData\Immunity\rfusclient.exe
C:\ProgramData\Immunity\rfusclient.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Immunity\CertMgry\CertMgr.Exe
MD5
229ee3f6a87b33f0c6e589c0ea3cc085

SHA1
6ca1cedc91693d63ab551768b9cec36646644895

SHA256
e5fdbb5bcf182f83fd162940125176340aef6b4e4ba43de072ca9ceb5cf1d3b9

SHA512
a3e8c722e6b05a476ed4025ea59d0e8146b7d86aa6a28c3e639ef2ff86b3b7c5f18270ddefa40c14863a42a3214827c0a1d37ba2eb5cfed46dfd7f266fe7c548

Download Submit
C:\ProgramData\Immunity\CertMgry\CertMgr.Exe
MD5
229ee3f6a87b33f0c6e589c0ea3cc085

SHA1
6ca1cedc91693d63ab551768b9cec36646644895

SHA256
e5fdbb5bcf182f83fd162940125176340aef6b4e4ba43de072ca9ceb5cf1d3b9

SHA512
a3e8c722e6b05a476ed4025ea59d0e8146b7d86aa6a28c3e639ef2ff86b3b7c5f18270ddefa40c14863a42a3214827c0a1d37ba2eb5cfed46dfd7f266fe7c548

Download Submit
C:\ProgramData\Immunity\CertMgry\Sert.cer
MD5
456f6e206be27f312c72160471ac50d9

SHA1
5e2169f36e05d5652ff097a43315eeca06fc5927

SHA256
66fda2cf3a0ac8b5aeefa719c9df707e06813dcf84d73c4501b05935895616cf

SHA512
ae8e476dd28900ebc44d70c3a40a4f86da64812841edbdd3f6d821d8db00fc8e9ff9e74c6ba8566961d8f2d721af198005817307e1b88bcb4606f28850191542

Download Submit
C:\ProgramData\Immunity\install.cmd
MD5
2f97c51dc9fa0bef75867fff87463bee

SHA1
b1d950c91a16d14348f7176fb9ee7bd9bad6020d

SHA256
95f7c688340bb527d98c43f0c558b936c903afba431b39cd24118041d5fa1169

SHA512
f361c5b6a22c916b9bb434b553c3dece38662d867b476d574f51bd420548507a89166ddc2a59da94faab546b47cdfc06d7e3ebbabd65fb79edc40a6240d4031c

Download Submit
C:\ProgramData\Immunity\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
C:\ProgramData\Immunity\rfusclient.exe
MD5
c21e287031cbdffa44ced93daa421f0c

SHA1
55153b60200428c44e5c5541ea2c93870c7a2ad0

SHA256
2dcd82e61b395b70679df7f63a843da3fe92be4dfd608be3e5e5bcdfb7f8848e

SHA512
3cc011cc5e9c05e8c18d210fc9698fcc33495df5c982181d6b3f3bc6aa30fb05f4bf57a6e2ca6db286be960db74fccbce7b5f843ca885c8a444529660f5bf595

Download Submit
C:\ProgramData\Immunity\rfusclient.exe
MD5
c21e287031cbdffa44ced93daa421f0c

SHA1
55153b60200428c44e5c5541ea2c93870c7a2ad0

SHA256
2dcd82e61b395b70679df7f63a843da3fe92be4dfd608be3e5e5bcdfb7f8848e

SHA512
3cc011cc5e9c05e8c18d210fc9698fcc33495df5c982181d6b3f3bc6aa30fb05f4bf57a6e2ca6db286be960db74fccbce7b5f843ca885c8a444529660f5bf595

Download Submit
C:\ProgramData\Immunity\rfusclient.exe
MD5
c21e287031cbdffa44ced93daa421f0c

SHA1
55153b60200428c44e5c5541ea2c93870c7a2ad0

SHA256
2dcd82e61b395b70679df7f63a843da3fe92be4dfd608be3e5e5bcdfb7f8848e

SHA512
3cc011cc5e9c05e8c18d210fc9698fcc33495df5c982181d6b3f3bc6aa30fb05f4bf57a6e2ca6db286be960db74fccbce7b5f843ca885c8a444529660f5bf595

Download Submit
C:\ProgramData\Immunity\rfusclient.exe
MD5
c21e287031cbdffa44ced93daa421f0c

SHA1
55153b60200428c44e5c5541ea2c93870c7a2ad0

SHA256
2dcd82e61b395b70679df7f63a843da3fe92be4dfd608be3e5e5bcdfb7f8848e

SHA512
3cc011cc5e9c05e8c18d210fc9698fcc33495df5c982181d6b3f3bc6aa30fb05f4bf57a6e2ca6db286be960db74fccbce7b5f843ca885c8a444529660f5bf595

Download Submit
C:\ProgramData\Immunity\rutserv.exe
MD5
43b697a1a52d948fcbeae234c3cbd21e

SHA1
d277fd70af98600d833c04d1cf19b856c1ff3873

SHA256
234799ce86abe8ecc1f768e2b319ed43e67e53f65ae9de1b85e44840f842ccff

SHA512
64d7fdfbc8524c3dfc3ecc1eb50805ba6b4d6904320d7e76ce3557c2496fa692c21f158f6f40407a2cd0064576161f1f263f9910223b9bb71e96ce71e4f02df2

Download Submit
C:\ProgramData\Immunity\rutserv.exe
MD5
43b697a1a52d948fcbeae234c3cbd21e

SHA1
d277fd70af98600d833c04d1cf19b856c1ff3873

SHA256
234799ce86abe8ecc1f768e2b319ed43e67e53f65ae9de1b85e44840f842ccff

SHA512
64d7fdfbc8524c3dfc3ecc1eb50805ba6b4d6904320d7e76ce3557c2496fa692c21f158f6f40407a2cd0064576161f1f263f9910223b9bb71e96ce71e4f02df2

Download Submit
C:\ProgramData\Immunity\rutserv.exe
MD5
43b697a1a52d948fcbeae234c3cbd21e

SHA1
d277fd70af98600d833c04d1cf19b856c1ff3873

SHA256
234799ce86abe8ecc1f768e2b319ed43e67e53f65ae9de1b85e44840f842ccff

SHA512
64d7fdfbc8524c3dfc3ecc1eb50805ba6b4d6904320d7e76ce3557c2496fa692c21f158f6f40407a2cd0064576161f1f263f9910223b9bb71e96ce71e4f02df2

Download Submit
C:\ProgramData\Immunity\rutserv.exe
MD5
43b697a1a52d948fcbeae234c3cbd21e

SHA1
d277fd70af98600d833c04d1cf19b856c1ff3873

SHA256
234799ce86abe8ecc1f768e2b319ed43e67e53f65ae9de1b85e44840f842ccff

SHA512
64d7fdfbc8524c3dfc3ecc1eb50805ba6b4d6904320d7e76ce3557c2496fa692c21f158f6f40407a2cd0064576161f1f263f9910223b9bb71e96ce71e4f02df2

Download Submit
C:\ProgramData\Immunity\rutserv.exe
MD5
43b697a1a52d948fcbeae234c3cbd21e

SHA1
d277fd70af98600d833c04d1cf19b856c1ff3873

SHA256
234799ce86abe8ecc1f768e2b319ed43e67e53f65ae9de1b85e44840f842ccff

SHA512
64d7fdfbc8524c3dfc3ecc1eb50805ba6b4d6904320d7e76ce3557c2496fa692c21f158f6f40407a2cd0064576161f1f263f9910223b9bb71e96ce71e4f02df2

Download Submit
C:\ProgramData\Immunity\ses.reg
MD5
496263c0b1024f6365f1ff3c38d59969

SHA1
3396118e467d3d146f66b1ae23894c24bd030295

SHA256
2d719041daa2ed97e7961a1d486e3adbad39523812dead9bf13ea50ffe47014b

SHA512
790884b208fa608229332dcc711d469aa63d6c13c3bc2da4b21223a629b0bbabfa2f8cf1303311d99033e10cd25c8c2b9a33d31c260ca0e62645bad4ba5c434e

Download Submit
C:\ProgramData\Immunity\settings.dat
MD5
e59e074dec13e9b9f64fc25d61665822

SHA1
e8aa1010c0fda21ef0b28d1bec2f68103f0d2fa7

SHA256
77408b37893683879b57e359de3a4c1c8c21d9b910847a45039d69f8fce5509f

SHA512
b86192d8a8b0d1e3c7de139fb8be200935111e55f9d3a6902b810b95fb09d2739680d355a956febbb12e672827f6deb8879f176477fe0dd0e66e36f9c6479f2f

Download Submit
C:\ProgramData\Immunity\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
C:\ProgramData\pass.exe
MD5
a5e2bb848405dfc3a56fc892b691b614

SHA1
7bc55828682e93191d6ee4c20e727308d0eeac6d

SHA256
ea5982c7dd3396d89d54ba0f0269b96807ab59111c22503ca5f9e593b78660f3

SHA512
0502630b436079ab2660134e6545ef18fc4b0927073b274e3fc4c706f49c417ad36ddd8f166c4a016ac0fa0065b88f75a921bee3e7029a9a5cb051a5faa7a954

Download Submit
C:\ProgramData\pass.exe
MD5
a5e2bb848405dfc3a56fc892b691b614

SHA1
7bc55828682e93191d6ee4c20e727308d0eeac6d

SHA256
ea5982c7dd3396d89d54ba0f0269b96807ab59111c22503ca5f9e593b78660f3

SHA512
0502630b436079ab2660134e6545ef18fc4b0927073b274e3fc4c706f49c417ad36ddd8f166c4a016ac0fa0065b88f75a921bee3e7029a9a5cb051a5faa7a954

Download Submit
C:\ProgramData\uacwev.bat
MD5
ace1a6c2ea9446d1bd4b645d00bc2c46

SHA1
a9c41e189775db5a507785c1c527ff9fb7a07bd6

SHA256
2b875f4d5f0722425969fd5963fa0276a101ce63ddb91e5960f2860ab0aedbf4

SHA512
1fba8400d354a46fe3e1b19f8a4d817df1ef4c1289d42a8a2257af45838b6b468a0632b9f31239fc45de11771aa9d9fb0b803a6cda359b14c24fb05f71bddbb2

Download Submit
C:\ProgramData\uxtheme.dll
MD5
531fcc0848cf13fa300600df16a71a87

SHA1
20bff8b5030d74afba1b4c20b5c8cc6f75011b62

SHA256
5b192bbc069b8aef74dabb1dd5459bda8ea2a64a7336db54e57afb38569ece68

SHA512
af8b8bbc666ce3c57e248acf056a3c65b2e4eea244c3c8dbb2d3765964407af93478a3d452a08862501f61994c964dd6048720742413506952395143841673e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\updachrome.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-41VNL.tmp\servs.tmp
MD5
c1b49299eb51afa1264d69fc022bb49b

SHA1
8126de1c2b2ec7d2ddd83735067aef2eefa77b37

SHA256
03b49d8261ed6fbfd23c6f1233e6c7fa131ff067d059fde696be60105286a895

SHA512
893e32f9a13c7b2b4e260c8acb6027fa3aa74c8268666012240aacbae2cbbf045b33cb256958a9ab230f0654c5452e4c3e114727e853431f63ec5d47719a9f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PSQEH.tmp\pass.tmp
MD5
c1b49299eb51afa1264d69fc022bb49b

SHA1
8126de1c2b2ec7d2ddd83735067aef2eefa77b37

SHA256
03b49d8261ed6fbfd23c6f1233e6c7fa131ff067d059fde696be60105286a895

SHA512
893e32f9a13c7b2b4e260c8acb6027fa3aa74c8268666012240aacbae2cbbf045b33cb256958a9ab230f0654c5452e4c3e114727e853431f63ec5d47719a9f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\servs.exe
MD5
6df7008811f88eeb253064a99c79f234

SHA1
41744103d74456cb63397841ef25945ca9e553bf

SHA256
4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

SHA512
1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

Download Submit
C:\Users\Admin\AppData\Local\Temp\servs.exe
MD5
6df7008811f88eeb253064a99c79f234

SHA1
41744103d74456cb63397841ef25945ca9e553bf

SHA256
4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

SHA512
1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

Download Submit
C:\Users\Admin\AppData\Roaming\updachrome.exe
MD5
2295742285186ecb7ff7c4634d31bdc8

SHA1
f76643300796393b1e616f7e2d925644faae5caf

SHA256
0cd1346813ea66e5ecb353180f0f01d9b2e53b230ccb5aece10e4366d632df25

SHA512
102a852a9f4b9513dd41935c96cda22647151f06f3f10601f1e1d65f938e539e0447eae4029de0c5a88762a2c6e29afccf14e5f10447f3cd5df75acfb9be605c

Download Submit
C:\Users\Admin\AppData\Roaming\updachrome.exe
MD5
2295742285186ecb7ff7c4634d31bdc8

SHA1
f76643300796393b1e616f7e2d925644faae5caf

SHA256
0cd1346813ea66e5ecb353180f0f01d9b2e53b230ccb5aece10e4366d632df25

SHA512
102a852a9f4b9513dd41935c96cda22647151f06f3f10601f1e1d65f938e539e0447eae4029de0c5a88762a2c6e29afccf14e5f10447f3cd5df75acfb9be605c

Download Submit
C:\Users\Admin\AppData\Roaming\updachrome.exe
MD5
2295742285186ecb7ff7c4634d31bdc8

SHA1
f76643300796393b1e616f7e2d925644faae5caf

SHA256
0cd1346813ea66e5ecb353180f0f01d9b2e53b230ccb5aece10e4366d632df25

SHA512
102a852a9f4b9513dd41935c96cda22647151f06f3f10601f1e1d65f938e539e0447eae4029de0c5a88762a2c6e29afccf14e5f10447f3cd5df75acfb9be605c

Download Submit
C:\Windows \System32\PasswordOnWakeSettingFlyout.exe
MD5
a81fed73da02db15df427da1cd5f4141

SHA1
f831fc6377a6264be621e23635f22b437129b2ce

SHA256
1afed5b9302a4a4669ac7f966b7cf9fcaab037e94a0b3cabea3631055c97d3a5

SHA512
3c4541160f0f69d1c3a9dc4e67643864493eadb0450426f7f323d87fa7b0c81d96ef2201d33b3421a307171274615e90d4ee8bd07107ff4f75beedec0a2bf156

Download Submit
C:\Windows \System32\UxTheme.dll
MD5
531fcc0848cf13fa300600df16a71a87

SHA1
20bff8b5030d74afba1b4c20b5c8cc6f75011b62

SHA256
5b192bbc069b8aef74dabb1dd5459bda8ea2a64a7336db54e57afb38569ece68

SHA512
af8b8bbc666ce3c57e248acf056a3c65b2e4eea244c3c8dbb2d3765964407af93478a3d452a08862501f61994c964dd6048720742413506952395143841673e3

Download Submit
\ProgramData\Immunity\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\ProgramData\Immunity\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\ProgramData\Immunity\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\ProgramData\Immunity\libeay32.dll
MD5
4cb2e1b9294ddae1bf7dcaaf42b365d1

SHA1
a225f53a8403d9b73d77bcbb075194520cce5a14

SHA256
a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

SHA512
46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Download Submit
\ProgramData\Immunity\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\ProgramData\Immunity\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\ProgramData\Immunity\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\ProgramData\Immunity\ssleay32.dll
MD5
5c268ca919854fc22d85f916d102ee7f

SHA1
0957cf86e0334673eb45945985b5c033b412be0e

SHA256
1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

SHA512
76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

Download Submit
\Windows \System32\uxtheme.dll
MD5
531fcc0848cf13fa300600df16a71a87

SHA1
20bff8b5030d74afba1b4c20b5c8cc6f75011b62

SHA256
5b192bbc069b8aef74dabb1dd5459bda8ea2a64a7336db54e57afb38569ece68

SHA512
af8b8bbc666ce3c57e248acf056a3c65b2e4eea244c3c8dbb2d3765964407af93478a3d452a08862501f61994c964dd6048720742413506952395143841673e3

Download Submit
memory/1096-44-0x0000000000000000-mapping.dmp

Download
memory/1200-48-0x0000000000000000-mapping.dmp

Download
memory/1652-41-0x0000000000000000-mapping.dmp

Download
memory/1996-56-0x0000000000000000-mapping.dmp

Download
memory/2188-231-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/2188-244-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/2188-243-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/2188-215-0x0000000000000000-mapping.dmp

Download
memory/2188-242-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/2188-228-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/2188-230-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/2612-40-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/2612-38-0x0000000000000000-mapping.dmp

Download
memory/2672-54-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2672-51-0x0000000000000000-mapping.dmp

Download
memory/3460-55-0x0000000000000000-mapping.dmp

Download
memory/3648-33-0x0000000007280000-0x0000000007281000-memory.dmp

Filesize
4KB

Download
memory/3648-31-0x00000000070B0000-0x00000000070B1000-memory.dmp

Filesize
4KB

Download
memory/3648-28-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/3648-27-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/3648-26-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/3648-25-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/3648-32-0x00000000077B0000-0x00000000077B1000-memory.dmp

Filesize
4KB

Download
memory/3648-24-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/3648-23-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/3648-20-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/3648-16-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3648-17-0x000000000041653A-mapping.dmp

Download
memory/3780-247-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/3780-249-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/3780-245-0x0000000000000000-mapping.dmp

Download
memory/3780-248-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/3948-10-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/3948-14-0x0000000007860000-0x0000000007903000-memory.dmp

Filesize
652KB

Download
memory/3948-9-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/3948-11-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/3948-8-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/3948-6-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3948-5-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/3948-2-0x0000000000000000-mapping.dmp

Download
memory/3948-15-0x0000000007500000-0x0000000007556000-memory.dmp

Filesize
344KB

Download
memory/3948-12-0x00000000074D0000-0x00000000074D5000-memory.dmp

Filesize
20KB

Download
memory/3948-13-0x0000000007580000-0x0000000007581000-memory.dmp

Filesize
4KB

Download
memory/4088-34-0x0000000000000000-mapping.dmp

Download
memory/4088-37-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/4104-227-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/4104-229-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4104-225-0x0000000004640000-0x0000000004641000-memory.dmp

Filesize
4KB

Download
memory/4104-216-0x0000000000000000-mapping.dmp

Download
memory/4128-57-0x0000000000000000-mapping.dmp

Download
memory/4172-59-0x0000000000000000-mapping.dmp

Download
memory/4236-61-0x0000000000000000-mapping.dmp

Download
memory/4316-74-0x0000000005A30000-0x0000000005A31000-memory.dmp

Filesize
4KB

Download
memory/4316-75-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/4316-69-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/4316-65-0x0000000000000000-mapping.dmp

Download
memory/4316-73-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/4316-77-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/4488-113-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-91-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-129-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/4488-130-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-109-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-103-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-95-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-93-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4488-92-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/4488-87-0x0000000000000000-mapping.dmp

Download
memory/4716-147-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4716-172-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4716-136-0x0000000000000000-mapping.dmp

Download
memory/4716-140-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4716-141-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/4716-142-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4716-166-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/4716-170-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4900-232-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

Filesize
4KB

Download
memory/4900-236-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/4900-224-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

Filesize
4KB

Download
memory/4900-200-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-196-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-185-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-226-0x0000000003C90000-0x0000000003C91000-memory.dmp

Filesize
4KB

Download
memory/4900-182-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-181-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/4900-212-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-180-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-234-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/4900-233-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

Filesize
4KB

Download
memory/4900-223-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

Filesize
4KB

Download
memory/4900-237-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/4900-238-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/4900-239-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/4900-240-0x00000000038E0000-0x00000000038E1000-memory.dmp

Filesize
4KB

Download
memory/4900-241-0x00000000038F0000-0x00000000038F1000-memory.dmp

Filesize
4KB

Download
memory/4900-179-0x0000000003920000-0x0000000003921000-memory.dmp

Filesize
4KB

Download
memory/4900-221-0x0000000003A30000-0x0000000003A31000-memory.dmp

Filesize
4KB

Download
memory/4900-222-0x0000000003B90000-0x0000000003B91000-memory.dmp

Filesize
4KB

Download
memory/4900-205-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-208-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-220-0x0000000003900000-0x0000000003901000-memory.dmp

Filesize
4KB

Download
memory/4900-217-0x00000000039E0000-0x00000000039E1000-memory.dmp

Filesize
4KB

Download
memory/4900-209-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-250-0x00000000016B0000-0x00000000016B1000-memory.dmp

Filesize
4KB

Download