Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
8win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
8win104
windows10_x64
8win104
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
10win105
windows10_x64
8win105
windows10_x64
8win105
windows10_x64
10win105
windows10_x64
8Resubmissions
12/11/2024, 01:29
241112-bwgrxs1gnf 1008/07/2021, 12:18
210708-8z6d5h8z2n 1006/07/2021, 17:53
210706-g6we6sa7sa 1019/06/2021, 18:17
210619-vr8bj2dzfn 1017/06/2021, 21:39
210617-a9cvlnmrbx 1011/06/2021, 17:26
210611-wvab1yw2tj 1008/06/2021, 06:47
210608-qrbpch3y46 1008/06/2021, 06:47
210608-64tndgm1ln 1005/06/2021, 18:40
210605-cd6qpr55sx 1004/06/2021, 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
135s -
max time network
296s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
17/05/2021, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win7v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win7v20210408
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral32
Sample
keygen-step-4d.exe
Resource
win10v20210408
General
-
Target
Install.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Malware Config
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral5/memory/5312-331-0x0000000000780000-0x000000000079E000-memory.dmp family_redline behavioral5/memory/5312-333-0x0000000002440000-0x000000000245D000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5652 created 3796 5652 svchost.exe 159 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Blocklisted process makes network request 52 IoCs
flow pid Process 124 5288 MsiExec.exe 125 5288 MsiExec.exe 126 5288 MsiExec.exe 127 5288 MsiExec.exe 128 5288 MsiExec.exe 129 5288 MsiExec.exe 130 5288 MsiExec.exe 132 5288 MsiExec.exe 133 5288 MsiExec.exe 134 5288 MsiExec.exe 135 5288 MsiExec.exe 136 5288 MsiExec.exe 137 5288 MsiExec.exe 138 5288 MsiExec.exe 139 5288 MsiExec.exe 140 5288 MsiExec.exe 141 5288 MsiExec.exe 143 5288 MsiExec.exe 148 5288 MsiExec.exe 151 5288 MsiExec.exe 152 5288 MsiExec.exe 153 5288 MsiExec.exe 154 5288 MsiExec.exe 155 5288 MsiExec.exe 156 5288 MsiExec.exe 157 5288 MsiExec.exe 158 5288 MsiExec.exe 159 5288 MsiExec.exe 160 5288 MsiExec.exe 161 5288 MsiExec.exe 163 5288 MsiExec.exe 166 5288 MsiExec.exe 168 5288 MsiExec.exe 169 5288 MsiExec.exe 170 5288 MsiExec.exe 172 5288 MsiExec.exe 173 5288 MsiExec.exe 174 5288 MsiExec.exe 175 5288 MsiExec.exe 176 5288 MsiExec.exe 177 5288 MsiExec.exe 180 5288 MsiExec.exe 182 5288 MsiExec.exe 183 5288 MsiExec.exe 184 5288 MsiExec.exe 185 5288 MsiExec.exe 186 5288 MsiExec.exe 187 5288 MsiExec.exe 236 5732 MsiExec.exe 237 5732 MsiExec.exe 238 5732 MsiExec.exe 239 5732 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 30 IoCs
pid Process 64 Install.tmp 2768 Ultra.exe 2416 ultramediaburner.exe 4012 ultramediaburner.tmp 1920 Caebipaesyqy.exe 3116 UltraMediaBurner.exe 2328 Homaelaveko.exe 4976 001.exe 4668 installer.exe 1028 hbggg.exe 4548 jfiag3g_gg.exe 5256 google-game.exe 5356 setup.exe 5520 jfiag3g_gg.exe 5608 askinstall39.exe 5536 customer1.exe 5712 jfiag3g_gg.exe 5180 toolspab1.exe 3904 jfiag3g_gg.exe 5980 toolspab1.exe 5312 15EA.exe 5552 005.exe 5580 installer.exe 5500 702564a0.exe 5200 2210.exe 3796 app.exe 6036 brwcuhv 5364 app.exe 5384 brwcuhv 5892 DC88.exe -
resource yara_rule behavioral5/files/0x000200000001abc2-171.dat upx behavioral5/files/0x000200000001abc2-170.dat upx behavioral5/files/0x000100000001ac1f-200.dat upx behavioral5/files/0x000100000001ac1f-201.dat upx behavioral5/files/0x000100000001ac30-284.dat upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Caebipaesyqy.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation google-game.exe -
Loads dropped DLL 63 IoCs
pid Process 64 Install.tmp 4668 installer.exe 4668 installer.exe 4668 installer.exe 4948 MsiExec.exe 4948 MsiExec.exe 5508 MicrosoftEdgeCP.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 5288 MsiExec.exe 4668 installer.exe 5288 MsiExec.exe 5288 MsiExec.exe 5980 toolspab1.exe 6112 MsiExec.exe 6112 MsiExec.exe 6112 MsiExec.exe 6112 MsiExec.exe 6112 MsiExec.exe 6112 MsiExec.exe 6112 MsiExec.exe 5288 MsiExec.exe 5580 installer.exe 5580 installer.exe 5580 installer.exe 5824 MsiExec.exe 5824 MsiExec.exe 5500 702564a0.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5732 MsiExec.exe 5580 installer.exe 5732 MsiExec.exe 5732 MsiExec.exe 4688 MsiExec.exe 4688 MsiExec.exe 4688 MsiExec.exe 4688 MsiExec.exe 4688 MsiExec.exe 4688 MsiExec.exe 4688 MsiExec.exe 5732 MsiExec.exe 5200 2210.exe 5200 2210.exe 5200 2210.exe 5200 2210.exe 5200 2210.exe 5200 2210.exe 5384 brwcuhv -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Mail\\SHyjepiwaery.exe\"" Ultra.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: installer.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\E: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 45 ip-api.com -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 82B39A7F7031E874 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 9B22A4C4688A6195 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2480 set thread context of 5668 2480 svchost.exe 115 PID 5180 set thread context of 5980 5180 toolspab1.exe 133 PID 6036 set thread context of 5384 6036 brwcuhv 177 -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\UltraMediaBurner\is-F6IDO.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files\Microsoft Office\WQPDXJNVVN\ultramediaburner.exe Ultra.exe File created C:\Program Files\Microsoft Office\WQPDXJNVVN\ultramediaburner.exe.config Ultra.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\Windows Mail\SHyjepiwaery.exe Ultra.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini msiexec.exe File created C:\Program Files (x86)\Windows Mail\SHyjepiwaery.exe.config Ultra.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe msiexec.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File created C:\Program Files (x86)\UltraMediaBurner\is-FV5MM.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp -
Drops file in Windows directory 54 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI50BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6DC8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI81F6.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI45CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI64F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6CAE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI492F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7D50.tmp msiexec.exe File created C:\Windows\Installer\f745ec2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI78A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4D7B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4E86.tmp msiexec.exe File created C:\Windows\Installer\f745ebf.msi msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4540.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6A3A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8266.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI812A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI458F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F73.tmp msiexec.exe File opened for modification C:\Windows\Installer\f745ebf.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8353.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A2B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4E66.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI6E94.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8314.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C01.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7B3B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI491E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI76F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8296.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI465C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7CC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI850B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A7A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI498E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F04.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI79B3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4176.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4FC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6AF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5011.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8226.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 702564a0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 702564a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI brwcuhv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI brwcuhv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI brwcuhv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 702564a0.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Kills process with taskkill 3 IoCs
pid Process 5856 taskkill.exe 2564 taskkill.exe 6080 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" app.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" app.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\17\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" app.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 00895dd7164bd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "5" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d2d5d9e4164bd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompletedV = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "328104111" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz! MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}\1 = "6076" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABEE = 0300000001000000140000004eef7faf0062d34abee6137e774438ae9988739f04000000010000001000000024d7172657e6b799f66cf32ae88b5c280f0000000100000020000000547b3c62613c9c2b025d5461623ae703e9853ee45a8bf3b425bf63528e992912140000000100000014000000fe7e60dd9d8292295edf1cf80869a75b98896ed01900000001000000100000002aac2185e0e1b6503eb16a495b1815fc5c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000eb050000308205e7308203cfa003020102021333000001a636dabe8bbe573d9a0000000001a6300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3231303331313139323835325a170d3232303631313139323835325a3081a9310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3127302506092a864886f70d010901161862696e6769657465616d406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0b49f5b650f0fa690df343367a2cd62155e98e3c0fc14cb1f696618be8c327ef257f50d47bce3a4286e36edc0382e0ac81096dbce62463bb552970d01d02a7ca642d6faed9b5878c4e2e33e7c9f94ea4eb7f125662d5d2fe78138ce3e827bd98969028a908fab20632542a1ef952c10382b7efcaae1f5e7521d5fb617a93aa002b579a3203726111c73a9832712e3b5d4d140b247c91824de8123b45ea39fbcdb6e5c77d68cd3db64dd24844a1879865356f655cf1c5d94b208e244bd075a9823c87af7bcad6aab52e3444aad2947a7baad0d42c9d785964dbd8b4e09004359094d0646c3ca98e7c698b0fa7d6f1606b1459fd6df8d9aea8ae85911789bc5e10203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414fe7e60dd9d8292295edf1cf80869a75b98896ed0301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382020100c1055e1c6ece899cbff031668bd0b72ee668484f9392c48efe112ba21c521af47582849539f2fd53f7f8adecc243743211150de90b106e6bdaaedb88a8fc71aff2bd4bfeae5628507aa3b47095bf680a0a56bc6cb9c70871fa0b05857bf1762af884469264870c4139f7f9e93bbedaf73a867994c51e7c8473506f1ca68a8f9059cfa5c068be7ecade98315eebd7e71431ebe7d033b4fc8056d94ab70b03e1368082fc83a82cd632b9f3a03f9c9d51881c39b432ee9856e87835bc0481e57489da3590d20b2b9b0900704de861f994d956a2c0347178c59e5048bb9bbfbe8cef237d5860d7f407dcbce486eee7d98a90509a8f1b81445453326b139f0d2fdc68b831681fa96f2284b8153e3dbe60cb2d0ac030d0e2ecfc85c9d361c25e01cabe57cd6ebdc40708b2bd449152e90d2d45d725db856ab64d29a9fdb9fdb85f6354cbd5be240f4b71fa745db8eb32c0e4ea4747bfa5a4f9a5346e42b3379636d05e52225cea1baa7792b8f51b803658026b11fd0ab5877a99f4e74ff994c61177ea425554a7135d8b020661d2d285eb8bf1aa00d3bf78e2f5dba62cd7befdb85fffe6c1b65643f56fe36cf412f366b03bc8c78c852c1ed43a218256636d67eb8241477d3258af4f96b9698b0326d6d01826734eb18f1b393cbf85c0f9fdab4fb854536110f2f678003f80f270cbb1fbeb5ba09523f959dfeba84319577874e4dec0 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000 msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall39.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall39.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5368 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4012 ultramediaburner.tmp 4012 ultramediaburner.tmp 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe 2328 Homaelaveko.exe -
Suspicious behavior: MapViewOfSection 53 IoCs
pid Process 4780 MicrosoftEdgeCP.exe 4780 MicrosoftEdgeCP.exe 5980 toolspab1.exe 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 1272 explorer.exe 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 6028 explorer.exe 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 5412 explorer.exe 3120 Process not Found 3120 Process not Found 5500 702564a0.exe 5384 brwcuhv -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2768 Ultra.exe Token: SeDebugPrivilege 1920 Caebipaesyqy.exe Token: SeDebugPrivilege 2328 Homaelaveko.exe Token: SeDebugPrivilege 4416 MicrosoftEdge.exe Token: SeDebugPrivilege 4416 MicrosoftEdge.exe Token: SeDebugPrivilege 4416 MicrosoftEdge.exe Token: SeDebugPrivilege 4416 MicrosoftEdge.exe Token: SeDebugPrivilege 5088 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5088 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5088 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5088 MicrosoftEdgeCP.exe Token: SeSecurityPrivilege 5056 msiexec.exe Token: SeCreateTokenPrivilege 4668 installer.exe Token: SeAssignPrimaryTokenPrivilege 4668 installer.exe Token: SeLockMemoryPrivilege 4668 installer.exe Token: SeIncreaseQuotaPrivilege 4668 installer.exe Token: SeMachineAccountPrivilege 4668 installer.exe Token: SeTcbPrivilege 4668 installer.exe Token: SeSecurityPrivilege 4668 installer.exe Token: SeTakeOwnershipPrivilege 4668 installer.exe Token: SeLoadDriverPrivilege 4668 installer.exe Token: SeSystemProfilePrivilege 4668 installer.exe Token: SeSystemtimePrivilege 4668 installer.exe Token: SeProfSingleProcessPrivilege 4668 installer.exe Token: SeIncBasePriorityPrivilege 4668 installer.exe Token: SeCreatePagefilePrivilege 4668 installer.exe Token: SeCreatePermanentPrivilege 4668 installer.exe Token: SeBackupPrivilege 4668 installer.exe Token: SeRestorePrivilege 4668 installer.exe Token: SeShutdownPrivilege 4668 installer.exe Token: SeDebugPrivilege 4668 installer.exe Token: SeAuditPrivilege 4668 installer.exe Token: SeSystemEnvironmentPrivilege 4668 installer.exe Token: SeChangeNotifyPrivilege 4668 installer.exe Token: SeRemoteShutdownPrivilege 4668 installer.exe Token: SeUndockPrivilege 4668 installer.exe Token: SeSyncAgentPrivilege 4668 installer.exe Token: SeEnableDelegationPrivilege 4668 installer.exe Token: SeManageVolumePrivilege 4668 installer.exe Token: SeImpersonatePrivilege 4668 installer.exe Token: SeCreateGlobalPrivilege 4668 installer.exe Token: SeCreateTokenPrivilege 4668 installer.exe Token: SeAssignPrimaryTokenPrivilege 4668 installer.exe Token: SeLockMemoryPrivilege 4668 installer.exe Token: SeIncreaseQuotaPrivilege 4668 installer.exe Token: SeMachineAccountPrivilege 4668 installer.exe Token: SeTcbPrivilege 4668 installer.exe Token: SeSecurityPrivilege 4668 installer.exe Token: SeTakeOwnershipPrivilege 4668 installer.exe Token: SeLoadDriverPrivilege 4668 installer.exe Token: SeSystemProfilePrivilege 4668 installer.exe Token: SeSystemtimePrivilege 4668 installer.exe Token: SeProfSingleProcessPrivilege 4668 installer.exe Token: SeIncBasePriorityPrivilege 4668 installer.exe Token: SeCreatePagefilePrivilege 4668 installer.exe Token: SeCreatePermanentPrivilege 4668 installer.exe Token: SeBackupPrivilege 4668 installer.exe Token: SeRestorePrivilege 4668 installer.exe Token: SeShutdownPrivilege 4668 installer.exe Token: SeDebugPrivilege 4668 installer.exe Token: SeAuditPrivilege 4668 installer.exe Token: SeSystemEnvironmentPrivilege 4668 installer.exe Token: SeChangeNotifyPrivilege 4668 installer.exe Token: SeRemoteShutdownPrivilege 4668 installer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4012 ultramediaburner.tmp 4668 installer.exe 5580 installer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4416 MicrosoftEdge.exe 4780 MicrosoftEdgeCP.exe 4780 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3120 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 64 4024 Install.exe 73 PID 4024 wrote to memory of 64 4024 Install.exe 73 PID 4024 wrote to memory of 64 4024 Install.exe 73 PID 64 wrote to memory of 2768 64 Install.tmp 76 PID 64 wrote to memory of 2768 64 Install.tmp 76 PID 2768 wrote to memory of 2416 2768 Ultra.exe 79 PID 2768 wrote to memory of 2416 2768 Ultra.exe 79 PID 2768 wrote to memory of 2416 2768 Ultra.exe 79 PID 2416 wrote to memory of 4012 2416 ultramediaburner.exe 80 PID 2416 wrote to memory of 4012 2416 ultramediaburner.exe 80 PID 2416 wrote to memory of 4012 2416 ultramediaburner.exe 80 PID 2768 wrote to memory of 1920 2768 Ultra.exe 81 PID 2768 wrote to memory of 1920 2768 Ultra.exe 81 PID 4012 wrote to memory of 3116 4012 ultramediaburner.tmp 82 PID 4012 wrote to memory of 3116 4012 ultramediaburner.tmp 82 PID 2768 wrote to memory of 2328 2768 Ultra.exe 83 PID 2768 wrote to memory of 2328 2768 Ultra.exe 83 PID 2328 wrote to memory of 4700 2328 Homaelaveko.exe 88 PID 2328 wrote to memory of 4700 2328 Homaelaveko.exe 88 PID 4700 wrote to memory of 4976 4700 cmd.exe 90 PID 4700 wrote to memory of 4976 4700 cmd.exe 90 PID 4700 wrote to memory of 4976 4700 cmd.exe 90 PID 2328 wrote to memory of 5040 2328 Homaelaveko.exe 91 PID 2328 wrote to memory of 5040 2328 Homaelaveko.exe 91 PID 5040 wrote to memory of 4668 5040 cmd.exe 93 PID 5040 wrote to memory of 4668 5040 cmd.exe 93 PID 5040 wrote to memory of 4668 5040 cmd.exe 93 PID 2328 wrote to memory of 4956 2328 Homaelaveko.exe 95 PID 2328 wrote to memory of 4956 2328 Homaelaveko.exe 95 PID 4956 wrote to memory of 1028 4956 cmd.exe 98 PID 4956 wrote to memory of 1028 4956 cmd.exe 98 PID 4956 wrote to memory of 1028 4956 cmd.exe 98 PID 1028 wrote to memory of 4548 1028 hbggg.exe 99 PID 1028 wrote to memory of 4548 1028 hbggg.exe 99 PID 1028 wrote to memory of 4548 1028 hbggg.exe 99 PID 5056 wrote to memory of 4948 5056 msiexec.exe 103 PID 5056 wrote to memory of 4948 5056 msiexec.exe 103 PID 5056 wrote to memory of 4948 5056 msiexec.exe 103 PID 4780 wrote to memory of 5088 4780 MicrosoftEdgeCP.exe 97 PID 4780 wrote to memory of 5088 4780 MicrosoftEdgeCP.exe 97 PID 4780 wrote to memory of 5088 4780 MicrosoftEdgeCP.exe 97 PID 2328 wrote to memory of 4776 2328 Homaelaveko.exe 104 PID 2328 wrote to memory of 4776 2328 Homaelaveko.exe 104 PID 2328 wrote to memory of 5196 2328 Homaelaveko.exe 106 PID 2328 wrote to memory of 5196 2328 Homaelaveko.exe 106 PID 4776 wrote to memory of 5256 4776 cmd.exe 108 PID 4776 wrote to memory of 5256 4776 cmd.exe 108 PID 4776 wrote to memory of 5256 4776 cmd.exe 108 PID 5196 wrote to memory of 5356 5196 cmd.exe 109 PID 5196 wrote to memory of 5356 5196 cmd.exe 109 PID 5196 wrote to memory of 5356 5196 cmd.exe 109 PID 4780 wrote to memory of 5088 4780 MicrosoftEdgeCP.exe 97 PID 4780 wrote to memory of 5088 4780 MicrosoftEdgeCP.exe 97 PID 4780 wrote to memory of 5088 4780 MicrosoftEdgeCP.exe 97 PID 2328 wrote to memory of 5416 2328 Homaelaveko.exe 110 PID 2328 wrote to memory of 5416 2328 Homaelaveko.exe 110 PID 4668 wrote to memory of 5496 4668 installer.exe 116 PID 4668 wrote to memory of 5496 4668 installer.exe 116 PID 4668 wrote to memory of 5496 4668 installer.exe 116 PID 5256 wrote to memory of 5508 5256 google-game.exe 131 PID 5256 wrote to memory of 5508 5256 google-game.exe 131 PID 5256 wrote to memory of 5508 5256 google-game.exe 131 PID 1028 wrote to memory of 5520 1028 hbggg.exe 113 PID 1028 wrote to memory of 5520 1028 hbggg.exe 113
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1196
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2272
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2752
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2384
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2360
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2332
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1892
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1356
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1288
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1084
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:932 -
C:\Users\Admin\AppData\Roaming\brwcuhvC:\Users\Admin\AppData\Roaming\brwcuhv2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6036 -
C:\Users\Admin\AppData\Roaming\brwcuhvC:\Users\Admin\AppData\Roaming\brwcuhv3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5384
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\is-CRE2N.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-CRE2N.tmp\Install.tmp" /SL5="$20116,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\is-28LO5.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-28LO5.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files\Microsoft Office\WQPDXJNVVN\ultramediaburner.exe"C:\Program Files\Microsoft Office\WQPDXJNVVN\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\is-7HNIE.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-7HNIE.tmp\ultramediaburner.tmp" /SL5="$4004A,281924,62464,C:\Program Files\Microsoft Office\WQPDXJNVVN\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:3116
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\93-d6cbb-9be-687bb-ab1194e7feab4\Caebipaesyqy.exe"C:\Users\Admin\AppData\Local\Temp\93-d6cbb-9be-687bb-ab1194e7feab4\Caebipaesyqy.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\83-d3a86-c4f-c709e-42ee88d4e636f\Homaelaveko.exe"C:\Users\Admin\AppData\Local\Temp\83-d3a86-c4f-c709e-42ee88d4e636f\Homaelaveko.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qwcsvf25.ukw\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\qwcsvf25.ukw\001.exeC:\Users\Admin\AppData\Local\Temp\qwcsvf25.ukw\001.exe6⤵
- Executes dropped EXE
PID:4976
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wcjji2uw.utd\installer.exe /qn CAMPAIGN="654" & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\wcjji2uw.utd\installer.exeC:\Users\Admin\AppData\Local\Temp\wcjji2uw.utd\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\wcjji2uw.utd\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\wcjji2uw.utd\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1620994662 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:5496
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x5vzndvr.r1o\hbggg.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\x5vzndvr.r1o\hbggg.exeC:\Users\Admin\AppData\Local\Temp\x5vzndvr.r1o\hbggg.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4548
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5520
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3tguwkuu.owg\google-game.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3tguwkuu.owg\google-game.exeC:\Users\Admin\AppData\Local\Temp\3tguwkuu.owg\google-game.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install7⤵PID:5508
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ug2j1adx.uli\setup.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\ug2j1adx.uli\setup.exeC:\Users\Admin\AppData\Local\Temp\ug2j1adx.uli\setup.exe6⤵
- Executes dropped EXE
PID:5356 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ug2j1adx.uli\setup.exe"7⤵PID:6076
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30008⤵
- Runs ping.exe
PID:5368
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4imzsy3x.skx\askinstall39.exe & exit5⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\4imzsy3x.skx\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\4imzsy3x.skx\askinstall39.exe6⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5608 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:5284
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:2564
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lmtte11t.f0f\customer1.exe & exit5⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\lmtte11t.f0f\customer1.exeC:\Users\Admin\AppData\Local\Temp\lmtte11t.f0f\customer1.exe6⤵
- Executes dropped EXE
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5712
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:3904
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oggqlsst.23w\toolspab1.exe & exit5⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\oggqlsst.23w\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\oggqlsst.23w\toolspab1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\oggqlsst.23w\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\oggqlsst.23w\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5980
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iea4cewp.1yz\GcleanerWW.exe /mixone & exit5⤵PID:2988
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ctbmohgs.qoi\005.exe & exit5⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\ctbmohgs.qoi\005.exeC:\Users\Admin\AppData\Local\Temp\ctbmohgs.qoi\005.exe6⤵
- Executes dropped EXE
PID:5552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\byxmh4cd.noa\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\byxmh4cd.noa\installer.exeC:\Users\Admin\AppData\Local\Temp\byxmh4cd.noa\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:5580 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\byxmh4cd.noa\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\byxmh4cd.noa\ EXE_CMD_LINE="/forcecleanup /wintime 1620994662 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:3300
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ohwsyiza.azc\702564a0.exe & exit5⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\ohwsyiza.azc\702564a0.exeC:\Users\Admin\AppData\Local\Temp\ohwsyiza.azc\702564a0.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h1ubt4in.z32\app.exe /8-2222 & exit5⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\h1ubt4in.z32\app.exeC:\Users\Admin\AppData\Local\Temp\h1ubt4in.z32\app.exe /8-22226⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\h1ubt4in.z32\app.exe"C:\Users\Admin\AppData\Local\Temp\h1ubt4in.z32\app.exe" /8-22227⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5364
-
-
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
PID:2480 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5668
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4416
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4456
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 79DDA4B3895AB6D346626B886A80B360 C2⤵
- Loads dropped DLL
PID:4948
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E2FC99A6D88572E245CAB89D1F344A552⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5288 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:5856
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E537862B013135ABFE00799A3DF9F5F6 E Global\MSI00002⤵
- Loads dropped DLL
PID:6112
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24872A509D5B6945D1931F506870172C C2⤵
- Loads dropped DLL
PID:5824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E5C2F3271741433D2D5B8A5810710CBD2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5732 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:6080
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE2DA2C8AE3A0A6BF0D483A41D2E0552 E Global\MSI00002⤵
- Loads dropped DLL
PID:4688
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Loads dropped DLL
- Modifies registry class
PID:5508
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4336
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4196
-
C:\Users\Admin\AppData\Local\Temp\15EA.exeC:\Users\Admin\AppData\Local\Temp\15EA.exe1⤵
- Executes dropped EXE
PID:5312
-
C:\Users\Admin\AppData\Local\Temp\2210.exeC:\Users\Admin\AppData\Local\Temp\2210.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5200
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1980
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3904
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5520
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1272
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3956
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:6028
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5228
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:5412
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1408
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5652
-
C:\Users\Admin\AppData\Local\Temp\DC88.exeC:\Users\Admin\AppData\Local\Temp\DC88.exe1⤵
- Executes dropped EXE
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\DC88.exeC:\Users\Admin\AppData\Local\Temp\DC88.exe2⤵PID:5624
-
-
C:\Users\Admin\AppData\Local\Temp\4025.exeC:\Users\Admin\AppData\Local\Temp\4025.exe1⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\4025.exeC:\Users\Admin\AppData\Local\Temp\4025.exe2⤵PID:6120
-