Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows10_x64
setup_x86_...6).exe
windows10_x64
setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows10_x64
10setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows10_x64
setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...3).exe
windows10_x64
setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows10_x64
setup_x86_...6).exe
windows10_x64
setup_x86_...7).exe
windows10_x64
setup_x86_...8).exe
windows10_x64
setup_x86_...9).exe
windows10_x64
setup_x86_...я.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
Resubmissions
11/07/2024, 05:43
240711-gej4lstgrf 1006/09/2021, 14:13
210906-rjpvrsedbm 1008/07/2021, 11:08
210708-4gztl3mwl6 1008/07/2021, 08:02
210708-klfb4qeda6 1007/07/2021, 09:39
210707-nem57xyvf2 1006/07/2021, 17:51
210706-7pcrmjy3fa 1006/07/2021, 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
1801s -
max time network
1808s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
25/06/2021, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (4).exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (5).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (6).exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (7).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (8).exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (9).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
General
-
Target
setup_x86_x64_install - копия (13).exe
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Extracted
fickerstealer
bukkva.club:80
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
resource yara_rule behavioral4/memory/2172-208-0x0000000000417F26-mapping.dmp family_redline behavioral4/memory/2172-207-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral4/files/0x000100000001abbc-312.dat family_redline behavioral4/files/0x000100000001abbf-316.dat family_redline behavioral4/files/0x000100000001abbf-315.dat family_redline behavioral4/files/0x000100000001abbc-311.dat family_redline behavioral4/memory/4700-337-0x0000000000417E22-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3484 created 3872 3484 WerFault.exe 85 -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 5504 created 5640 5504 svchost.exe 155 PID 5504 created 5624 5504 svchost.exe 159 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral4/memory/3872-283-0x0000000000AC0000-0x0000000000B5D000-memory.dmp family_vidar behavioral4/memory/3872-287-0x0000000000400000-0x0000000000949000-memory.dmp family_vidar -
resource yara_rule behavioral4/files/0x000100000001aba8-118.dat aspack_v212_v242 behavioral4/files/0x000100000001aba8-119.dat aspack_v212_v242 behavioral4/files/0x000100000001aba3-121.dat aspack_v212_v242 behavioral4/files/0x000100000001aba6-129.dat aspack_v212_v242 behavioral4/files/0x000100000001aba3-128.dat aspack_v212_v242 behavioral4/files/0x000100000001aba3-127.dat aspack_v212_v242 behavioral4/files/0x000100000001aba6-126.dat aspack_v212_v242 behavioral4/files/0x000100000001aba4-122.dat aspack_v212_v242 behavioral4/files/0x000100000001aba4-120.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 4032 setup_installer.exe 2268 setup_install.exe 2212 arnatic_2.exe 3872 arnatic_1.exe 3960 arnatic_4.exe 2932 arnatic_7.exe 3384 arnatic_5.exe 2808 arnatic_3.exe 1956 arnatic_6.exe 3672 43322006833.exe 2172 arnatic_7.exe 4680 1301803.exe 4776 1QMssKm_IYdaioV_5CCnnujj.exe 4840 6606510.exe 4864 s_P0lcnceFyTXHlYmkVb1L3E.exe 4956 jfiag3g_gg.exe 5020 WinHoster.exe 3280 8011372.exe 2964 NYQuUom2Wkp8AK9m7Wy1itL5.exe 4300 CL8qPFmTNwttTv6eHZRDYnxy.exe 4348 w4swv9b5p8hZmEi_xCiNlIBS.exe 3588 chrome.exe 4304 3196738.exe 2792 wDC2OSWIrK04OVDfHmDRYwou.exe 2684 file4.exe 1660 chrome.exe 2228 jooyu.exe 656 chrome.exe 640 chrome.exe 3672 43322006833.exe 1760 9Ol2WgOIC8pxwfqN3YKQ_e_J.exe 2244 md8_8eus.exe 4700 DtVV363oiOEiQufJjyRDVD8C.exe 808 jfiag3g_gg.exe 644 jfiag3g_gg.exe 1960 1QMssKm_IYdaioV_5CCnnujj.exe 3944 jfiag3g_gg.exe 4804 jfiag3g_gg.exe 3672 43322006833.exe 6092 12194457396.exe 6000 43322006833.exe 5640 00gH8XkXATBTtu45CwxwPmMO.exe 5180 1624583826605.exe 5624 8TobZiuPpKHhWD9Pjoq0wISe.exe 5652 00gH8XkXATBTtu45CwxwPmMO.exe 5588 8TobZiuPpKHhWD9Pjoq0wISe.exe 5464 htuuwai 5264 bduuwai 2364 bduuwai 6040 jfiag3g_gg.exe 2520 jfiag3g_gg.exe 2412 jfiag3g_gg.exe 3196 htuuwai 3596 bduuwai 3228 C133.exe 2696 C701.exe 4620 CEC2.exe 2788 D7DB.exe 3532 C133.exe 2320 bduuwai 4612 C133.exe 4552 C133.exe 2080 C133.exe 4692 C133.exe -
resource yara_rule behavioral4/files/0x000100000001abac-183.dat upx behavioral4/files/0x000100000001abac-184.dat upx behavioral4/files/0x000100000001abb2-279.dat upx behavioral4/files/0x000100000001abb2-278.dat upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion w4swv9b5p8hZmEi_xCiNlIBS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion w4swv9b5p8hZmEi_xCiNlIBS.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation arnatic_3.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation 43322006833.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation arnatic_7.exe -
Loads dropped DLL 27 IoCs
pid Process 2268 setup_install.exe 2268 setup_install.exe 2268 setup_install.exe 2268 setup_install.exe 2268 setup_install.exe 2268 setup_install.exe 2268 setup_install.exe 2268 setup_install.exe 2168 rUNdlL32.eXe 2212 arnatic_2.exe 1544 rUNdlL32.eXe 1960 1QMssKm_IYdaioV_5CCnnujj.exe 4864 s_P0lcnceFyTXHlYmkVb1L3E.exe 4864 s_P0lcnceFyTXHlYmkVb1L3E.exe 656 chrome.exe 656 chrome.exe 5464 htuuwai 2364 bduuwai 2696 C701.exe 2696 C701.exe 2696 C701.exe 2696 C701.exe 2696 C701.exe 3196 htuuwai 2320 bduuwai 2860 bduuwai 1220 htuuwai -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral4/files/0x000100000001abbc-312.dat themida behavioral4/files/0x000100000001abbf-316.dat themida behavioral4/files/0x000100000001abbf-315.dat themida behavioral4/files/0x000100000001abbc-311.dat themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6606510.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA w4swv9b5p8hZmEi_xCiNlIBS.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ipinfo.io 99 ipinfo.io 115 ipinfo.io 272 icanhazip.com 11 ip-api.com 100 ipinfo.io 116 ipinfo.io 243 ipinfo.io 250 api.ipify.org 14 ipinfo.io 110 ipinfo.io 114 ipinfo.io 165 api.ipify.org 271 icanhazip.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 42475AA096E78314 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 6890CBAF0536A6C9 svchost.exe File opened for modification C:\Windows\System32\Tasks\Videocard Service svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3588 chrome.exe 4348 w4swv9b5p8hZmEi_xCiNlIBS.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 3580 set thread context of 2008 3580 svchost.exe 98 PID 2932 set thread context of 2172 2932 arnatic_7.exe 94 PID 1660 set thread context of 4700 1660 chrome.exe 124 PID 4776 set thread context of 1960 4776 1QMssKm_IYdaioV_5CCnnujj.exe 128 PID 3672 set thread context of 6000 3672 43322006833.exe 152 PID 5264 set thread context of 2364 5264 bduuwai 242 PID 3596 set thread context of 2320 3596 bduuwai 267 PID 3868 set thread context of 2860 3868 bduuwai 284 -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe File created C:\Program Files\Mozilla Firefox\DotNetZip-0chwvhlr.tmp 9Ol2WgOIC8pxwfqN3YKQ_e_J.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\resources.pak 9Ol2WgOIC8pxwfqN3YKQ_e_J.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe CL8qPFmTNwttTv6eHZRDYnxy.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe CL8qPFmTNwttTv6eHZRDYnxy.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\file4.exe CL8qPFmTNwttTv6eHZRDYnxy.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jingzhang.exe CL8qPFmTNwttTv6eHZRDYnxy.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe CL8qPFmTNwttTv6eHZRDYnxy.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini CL8qPFmTNwttTv6eHZRDYnxy.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4768 4680 WerFault.exe 99 3484 3872 WerFault.exe 85 -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1QMssKm_IYdaioV_5CCnnujj.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1QMssKm_IYdaioV_5CCnnujj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1QMssKm_IYdaioV_5CCnnujj.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bduuwai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI htuuwai -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 43322006833.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 43322006833.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 12194457396.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString s_P0lcnceFyTXHlYmkVb1L3E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 s_P0lcnceFyTXHlYmkVb1L3E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 12194457396.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4156 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 5920 timeout.exe 5380 timeout.exe 4440 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 3 IoCs
pid Process 3972 taskkill.exe 4196 taskkill.exe 2476 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 00gH8XkXATBTtu45CwxwPmMO.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 8TobZiuPpKHhWD9Pjoq0wISe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 00gH8XkXATBTtu45CwxwPmMO.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "331361661" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "331389508" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{ECA5297C-654D-4F6A-A3D3-45F171224141}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K} rUNdlL32.eXe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000003e99893a084bf8a82c2047dacbd939bb66fdb3b99fae7e9aed46e3e2b179178bbdec74094770bdf94351e93a366a2a0a59eba649c1047e1003e53b420abf4e9a79bdc308bf1ea95379e6667a5dccb6585f66994f5cb329cf4d788b900d255b0b942ae1a304f6bcac4100de1ac39e3ffc7a8ee645555bc407c4201b67774cd0945e554030a9962886c8be49f46b824bd2828325973d9c4e6465fe5902f8d41dd3e75c24f15fa018eceb42a4a62517fb35b9656dca60167d8d673086b0835dc0f7596148e654b2e2026fab4716ddfc7d00d354b6784b698642b1d7b68ede87509fc782d76da36d1526621943e826d3ec9cdb70ab17f5345e00e4130c9417f303a57ee1f7b249722197e8ab0e0a7f3b202ad2d98a91e719c1340305a5ed483fe30f289d91efd85f7dbdd783440dd0d39eadc7af8aadb6b7b90815cbddad040c160bb1d55d7e24d678ef0bc021ba3a3d9255d1128b46f9aeefb4ce869ec4fcfa34f530abc5b6ce751dd70d82ccf57818d9cbdf22e957f09e926676570651c5a91f74ed3d80a19cdde25f6be945f6d603c296c0ffdacf7327cbbb0b1af651b5f75ae250dc895c62cb MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABEE MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}\1 = "2302" rUNdlL32.eXe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} rUNdlL32.eXe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 arnatic_1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e arnatic_1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2168 rUNdlL32.eXe 2168 rUNdlL32.eXe 3580 svchost.exe 3580 svchost.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 4956 jfiag3g_gg.exe 4956 jfiag3g_gg.exe 2212 arnatic_2.exe 2212 arnatic_2.exe 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 Process not Found -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 2212 arnatic_2.exe 1960 1QMssKm_IYdaioV_5CCnnujj.exe 4372 MicrosoftEdgeCP.exe 5464 htuuwai 2364 bduuwai 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 3044 Process not Found 3044 Process not Found 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 3044 Process not Found 3044 Process not Found 4972 explorer.exe 4972 explorer.exe 5976 explorer.exe 5976 explorer.exe 3044 Process not Found 3044 Process not Found 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 3044 Process not Found 3044 Process not Found 4972 explorer.exe 4972 explorer.exe 2632 explorer.exe 2632 explorer.exe 4972 explorer.exe 4972 explorer.exe 3044 Process not Found 3044 Process not Found 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 5976 explorer.exe 5976 explorer.exe 4972 explorer.exe 4972 explorer.exe 5976 explorer.exe 5976 explorer.exe 5976 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3384 arnatic_5.exe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 3580 svchost.exe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 2168 rUNdlL32.eXe Token: SeDebugPrivilege 4768 WerFault.exe Token: SeDebugPrivilege 2172 arnatic_7.exe Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeDebugPrivilege 3280 8011372.exe Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeDebugPrivilege 4304 3196738.exe Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 640 chrome.exe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 3588 chrome.exe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 4348 w4swv9b5p8hZmEi_xCiNlIBS.exe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeDebugPrivilege 1544 rUNdlL32.eXe Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeAssignPrimaryTokenPrivilege 2760 svchost.exe Token: SeIncreaseQuotaPrivilege 2760 svchost.exe Token: SeSecurityPrivilege 2760 svchost.exe Token: SeTakeOwnershipPrivilege 2760 svchost.exe Token: SeLoadDriverPrivilege 2760 svchost.exe Token: SeSystemtimePrivilege 2760 svchost.exe Token: SeBackupPrivilege 2760 svchost.exe Token: SeRestorePrivilege 2760 svchost.exe Token: SeShutdownPrivilege 2760 svchost.exe Token: SeSystemEnvironmentPrivilege 2760 svchost.exe Token: SeUndockPrivilege 2760 svchost.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 3044 Process not Found 3044 Process not Found 4448 firefox.exe 4448 firefox.exe 4448 firefox.exe 4448 firefox.exe 6092 12194457396.exe 6092 12194457396.exe 4640 chrome.exe 3044 Process not Found 3044 Process not Found 4640 chrome.exe 4640 chrome.exe 3044 Process not Found 3044 Process not Found -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 4448 firefox.exe 4448 firefox.exe 4448 firefox.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4448 firefox.exe 3044 Process not Found 4236 MicrosoftEdge.exe 4372 MicrosoftEdgeCP.exe 4372 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3044 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 4032 3944 setup_x86_x64_install - копия (13).exe 76 PID 3944 wrote to memory of 4032 3944 setup_x86_x64_install - копия (13).exe 76 PID 3944 wrote to memory of 4032 3944 setup_x86_x64_install - копия (13).exe 76 PID 4032 wrote to memory of 2268 4032 setup_installer.exe 77 PID 4032 wrote to memory of 2268 4032 setup_installer.exe 77 PID 4032 wrote to memory of 2268 4032 setup_installer.exe 77 PID 2268 wrote to memory of 1292 2268 setup_install.exe 80 PID 2268 wrote to memory of 1292 2268 setup_install.exe 80 PID 2268 wrote to memory of 1292 2268 setup_install.exe 80 PID 2268 wrote to memory of 2136 2268 setup_install.exe 81 PID 2268 wrote to memory of 2136 2268 setup_install.exe 81 PID 2268 wrote to memory of 2136 2268 setup_install.exe 81 PID 2268 wrote to memory of 2560 2268 setup_install.exe 82 PID 2268 wrote to memory of 2560 2268 setup_install.exe 82 PID 2268 wrote to memory of 2560 2268 setup_install.exe 82 PID 2268 wrote to memory of 3160 2268 setup_install.exe 93 PID 2268 wrote to memory of 3160 2268 setup_install.exe 93 PID 2268 wrote to memory of 3160 2268 setup_install.exe 93 PID 2268 wrote to memory of 3840 2268 setup_install.exe 92 PID 2268 wrote to memory of 3840 2268 setup_install.exe 92 PID 2268 wrote to memory of 3840 2268 setup_install.exe 92 PID 2268 wrote to memory of 2044 2268 setup_install.exe 91 PID 2268 wrote to memory of 2044 2268 setup_install.exe 91 PID 2268 wrote to memory of 2044 2268 setup_install.exe 91 PID 2136 wrote to memory of 2212 2136 cmd.exe 90 PID 2136 wrote to memory of 2212 2136 cmd.exe 90 PID 2136 wrote to memory of 2212 2136 cmd.exe 90 PID 2268 wrote to memory of 2120 2268 setup_install.exe 83 PID 2268 wrote to memory of 2120 2268 setup_install.exe 83 PID 2268 wrote to memory of 2120 2268 setup_install.exe 83 PID 1292 wrote to memory of 3872 1292 cmd.exe 85 PID 1292 wrote to memory of 3872 1292 cmd.exe 85 PID 1292 wrote to memory of 3872 1292 cmd.exe 85 PID 3160 wrote to memory of 3960 3160 cmd.exe 84 PID 3160 wrote to memory of 3960 3160 cmd.exe 84 PID 3160 wrote to memory of 3960 3160 cmd.exe 84 PID 2120 wrote to memory of 2932 2120 cmd.exe 89 PID 2120 wrote to memory of 2932 2120 cmd.exe 89 PID 2120 wrote to memory of 2932 2120 cmd.exe 89 PID 3840 wrote to memory of 3384 3840 cmd.exe 87 PID 3840 wrote to memory of 3384 3840 cmd.exe 87 PID 2560 wrote to memory of 2808 2560 cmd.exe 86 PID 2560 wrote to memory of 2808 2560 cmd.exe 86 PID 2560 wrote to memory of 2808 2560 cmd.exe 86 PID 2044 wrote to memory of 1956 2044 cmd.exe 88 PID 2044 wrote to memory of 1956 2044 cmd.exe 88 PID 2044 wrote to memory of 1956 2044 cmd.exe 88 PID 2932 wrote to memory of 2172 2932 arnatic_7.exe 94 PID 2932 wrote to memory of 2172 2932 arnatic_7.exe 94 PID 2932 wrote to memory of 2172 2932 arnatic_7.exe 94 PID 2808 wrote to memory of 2168 2808 arnatic_3.exe 95 PID 2808 wrote to memory of 2168 2808 arnatic_3.exe 95 PID 2808 wrote to memory of 2168 2808 arnatic_3.exe 95 PID 2168 wrote to memory of 3580 2168 rUNdlL32.eXe 69 PID 3960 wrote to memory of 3672 3960 arnatic_4.exe 135 PID 3960 wrote to memory of 3672 3960 arnatic_4.exe 135 PID 3960 wrote to memory of 3672 3960 arnatic_4.exe 135 PID 3580 wrote to memory of 2008 3580 svchost.exe 98 PID 3580 wrote to memory of 2008 3580 svchost.exe 98 PID 2168 wrote to memory of 2844 2168 rUNdlL32.eXe 35 PID 3580 wrote to memory of 2008 3580 svchost.exe 98 PID 2168 wrote to memory of 996 2168 rUNdlL32.eXe 13 PID 2168 wrote to memory of 2436 2168 rUNdlL32.eXe 43 PID 2932 wrote to memory of 2172 2932 arnatic_7.exe 94
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:996
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:680 -
C:\Users\Admin\AppData\Roaming\bduuwaiC:\Users\Admin\AppData\Roaming\bduuwai2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5264 -
C:\Users\Admin\AppData\Roaming\bduuwaiC:\Users\Admin\AppData\Roaming\bduuwai3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2364
-
-
-
C:\Users\Admin\AppData\Roaming\htuuwaiC:\Users\Admin\AppData\Roaming\htuuwai2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5464
-
-
C:\Users\Admin\AppData\Roaming\htuuwaiC:\Users\Admin\AppData\Roaming\htuuwai2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:3196
-
-
C:\Users\Admin\AppData\Roaming\bduuwaiC:\Users\Admin\AppData\Roaming\bduuwai2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3596 -
C:\Users\Admin\AppData\Roaming\bduuwaiC:\Users\Admin\AppData\Roaming\bduuwai3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:2320
-
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵
- Executes dropped EXE
PID:3532
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵
- Executes dropped EXE
PID:4612
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵
- Executes dropped EXE
PID:4552
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵
- Executes dropped EXE
PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵
- Executes dropped EXE
PID:4692
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:5556
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:4644
-
-
C:\Users\Admin\AppData\Roaming\htuuwaiC:\Users\Admin\AppData\Roaming\htuuwai2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:1220
-
-
C:\Users\Admin\AppData\Roaming\bduuwaiC:\Users\Admin\AppData\Roaming\bduuwai2⤵
- Suspicious use of SetThreadContext
PID:3868 -
C:\Users\Admin\AppData\Roaming\bduuwaiC:\Users\Admin\AppData\Roaming\bduuwai3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:2860
-
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:5464
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:3648
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:3608
-
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe2⤵PID:6108
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1104
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2844
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2780
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2464
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2436
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1884
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1392
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1380
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (13).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (13).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 9086⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
PID:3484
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_7.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3160
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_4.exearnatic_4.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
PID:6040
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:4644
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_5.exearnatic_5.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3384 -
C:\Users\Admin\AppData\Roaming\1301803.exe"C:\Users\Admin\AppData\Roaming\1301803.exe"2⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4680 -s 9403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
-
C:\Users\Admin\AppData\Roaming\6606510.exe"C:\Users\Admin\AppData\Roaming\6606510.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4840 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
PID:5020
-
-
-
C:\Users\Admin\AppData\Roaming\8011372.exe"C:\Users\Admin\AppData\Roaming\8011372.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Users\Admin\AppData\Roaming\3196738.exe"C:\Users\Admin\AppData\Roaming\3196738.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0CFE6F54\arnatic_6.exearnatic_6.exe1⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\Documents\1QMssKm_IYdaioV_5CCnnujj.exe"C:\Users\Admin\Documents\1QMssKm_IYdaioV_5CCnnujj.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4776 -
C:\Users\Admin\Documents\1QMssKm_IYdaioV_5CCnnujj.exe"C:\Users\Admin\Documents\1QMssKm_IYdaioV_5CCnnujj.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1960
-
-
-
C:\Users\Admin\Documents\s_P0lcnceFyTXHlYmkVb1L3E.exe"C:\Users\Admin\Documents\s_P0lcnceFyTXHlYmkVb1L3E.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4864 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im s_P0lcnceFyTXHlYmkVb1L3E.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\s_P0lcnceFyTXHlYmkVb1L3E.exe" & del C:\ProgramData\*.dll & exit3⤵PID:4516
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im s_P0lcnceFyTXHlYmkVb1L3E.exe /f4⤵
- Kills process with taskkill
PID:2476
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:4440
-
-
-
-
C:\Users\Admin\Documents\NYQuUom2Wkp8AK9m7Wy1itL5.exe"C:\Users\Admin\Documents\NYQuUom2Wkp8AK9m7Wy1itL5.exe"2⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\43322006833.exe"3⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\43322006833.exe"C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\43322006833.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\43322006833.exe"C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\43322006833.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\1624583826605.exe"C:\Users\Admin\AppData\Local\Temp\1624583826605.exe"6⤵
- Executes dropped EXE
PID:5180
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\12194457396.exe" /mix3⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\12194457396.exe"C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\12194457396.exe" /mix4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:6092 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\mqoxVgui & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{bRmu-xGXdw-D12Q-muN4P}\12194457396.exe"5⤵PID:5504
-
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
PID:5380
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "NYQuUom2Wkp8AK9m7Wy1itL5.exe" /f & erase "C:\Users\Admin\Documents\NYQuUom2Wkp8AK9m7Wy1itL5.exe" & exit3⤵PID:5916
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "NYQuUom2Wkp8AK9m7Wy1itL5.exe" /f4⤵
- Kills process with taskkill
PID:4196
-
-
-
-
C:\Users\Admin\Documents\CL8qPFmTNwttTv6eHZRDYnxy.exe"C:\Users\Admin\Documents\CL8qPFmTNwttTv6eHZRDYnxy.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4300 -
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:808
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:4804
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:5892
-
-
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"3⤵
- Executes dropped EXE
PID:2684
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"3⤵PID:3672
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl4⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:2244
-
-
-
C:\Users\Admin\Documents\w4swv9b5p8hZmEi_xCiNlIBS.exe"C:\Users\Admin\Documents\w4swv9b5p8hZmEi_xCiNlIBS.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Users\Admin\Documents\dMTL43wOvzuS31ur3CMaetKH.exe"C:\Users\Admin\Documents\dMTL43wOvzuS31ur3CMaetKH.exe"2⤵PID:3588
-
-
C:\Users\Admin\Documents\wDC2OSWIrK04OVDfHmDRYwou.exe"C:\Users\Admin\Documents\wDC2OSWIrK04OVDfHmDRYwou.exe"2⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:644
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:4552
-
-
-
C:\Users\Admin\Documents\69ytjsYfZJj5cTemXWTKqhr5.exe"C:\Users\Admin\Documents\69ytjsYfZJj5cTemXWTKqhr5.exe"2⤵PID:640
-
-
C:\Users\Admin\Documents\Ocq1WB_3mw5axfrl4u4q7v_a.exe"C:\Users\Admin\Documents\Ocq1WB_3mw5axfrl4u4q7v_a.exe"2⤵PID:656
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Ocq1WB_3mw5axfrl4u4q7v_a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Ocq1WB_3mw5axfrl4u4q7v_a.exe" & del C:\ProgramData\*.dll & exit3⤵PID:2280
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Ocq1WB_3mw5axfrl4u4q7v_a.exe /f4⤵
- Kills process with taskkill
PID:3972
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5920
-
-
-
-
C:\Users\Admin\Documents\DtVV363oiOEiQufJjyRDVD8C.exe"C:\Users\Admin\Documents\DtVV363oiOEiQufJjyRDVD8C.exe"2⤵PID:1660
-
C:\Users\Admin\Documents\DtVV363oiOEiQufJjyRDVD8C.exeC:\Users\Admin\Documents\DtVV363oiOEiQufJjyRDVD8C.exe3⤵
- Executes dropped EXE
PID:4700
-
-
-
C:\Users\Admin\Documents\9Ol2WgOIC8pxwfqN3YKQ_e_J.exe"C:\Users\Admin\Documents\9Ol2WgOIC8pxwfqN3YKQ_e_J.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1760 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:4240
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4448 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4448.0.537612151\386260209" -parentBuildID 20200403170909 -prefsHandle 1468 -prefMapHandle 1460 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4448 "\\.\pipe\gecko-crash-server-pipe.4448" 1548 gpu5⤵PID:5228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4448.3.1270011716\727724231" -childID 1 -isForBrowser -prefsHandle 5472 -prefMapHandle 5468 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4448 "\\.\pipe\gecko-crash-server-pipe.4448" 5484 tab5⤵PID:5448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4448.13.2147453526\897289787" -childID 2 -isForBrowser -prefsHandle 5168 -prefMapHandle 5208 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4448 "\\.\pipe\gecko-crash-server-pipe.4448" 4376 tab5⤵PID:5676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4448.20.1922160301\731059910" -childID 3 -isForBrowser -prefsHandle 4536 -prefMapHandle 4564 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4448 "\\.\pipe\gecko-crash-server-pipe.4448" 4428 tab5⤵PID:5740
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:4640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe28dd4f50,0x7ffe28dd4f60,0x7ffe28dd4f704⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1996 /prefetch:84⤵PID:5956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1704 /prefetch:84⤵PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:24⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:14⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:14⤵PID:5604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:14⤵PID:5724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:14⤵PID:5712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:14⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:14⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:84⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:84⤵PID:340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:84⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5176 /prefetch:84⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5360 /prefetch:84⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:84⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:84⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1868 /prefetch:84⤵PID:5492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3864 /prefetch:84⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:84⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings4⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:84⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5764 /prefetch:84⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7276 /prefetch:84⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7124 /prefetch:84⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:84⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5192 /prefetch:84⤵PID:508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:84⤵PID:5468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:84⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7936 /prefetch:84⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5708 /prefetch:84⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6220 /prefetch:84⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:84⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:84⤵PID:5944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7428 /prefetch:84⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:84⤵PID:6064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5548 /prefetch:84⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6192 /prefetch:84⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6440 /prefetch:84⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3832 /prefetch:84⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5708 /prefetch:84⤵PID:5320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3880 /prefetch:84⤵PID:584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:84⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1864 /prefetch:84⤵PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:84⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 /prefetch:84⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 /prefetch:84⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 /prefetch:84⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:84⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:84⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7156 /prefetch:84⤵PID:5432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1340 /prefetch:84⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:14⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:14⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1556 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:14⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1384 /prefetch:84⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:84⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:84⤵PID:692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,6213790120716710462,9559401336553487401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7132 /prefetch:84⤵PID:2472
-
-
-
-
C:\Users\Admin\Documents\00gH8XkXATBTtu45CwxwPmMO.exe"C:\Users\Admin\Documents\00gH8XkXATBTtu45CwxwPmMO.exe"2⤵
- Executes dropped EXE
PID:5640 -
C:\Users\Admin\Documents\00gH8XkXATBTtu45CwxwPmMO.exe"C:\Users\Admin\Documents\00gH8XkXATBTtu45CwxwPmMO.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5652
-
-
-
C:\Users\Admin\Documents\8TobZiuPpKHhWD9Pjoq0wISe.exe"C:\Users\Admin\Documents\8TobZiuPpKHhWD9Pjoq0wISe.exe"2⤵
- Executes dropped EXE
PID:5624 -
C:\Users\Admin\Documents\8TobZiuPpKHhWD9Pjoq0wISe.exe"C:\Users\Admin\Documents\8TobZiuPpKHhWD9Pjoq0wISe.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5588
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5504
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7bc6ea890,0x7ff7bc6ea8a0,0x7ff7bc6ea8b01⤵PID:4216
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:4216
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4236
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4548
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4372
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5860
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:1640
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:1532
-
C:\Users\Admin\AppData\Local\Temp\C133.exeC:\Users\Admin\AppData\Local\Temp\C133.exe1⤵
- Executes dropped EXE
PID:3228 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Videocard Service" /tr "C:\Users\Admin\AppData\Local\Temp\C133.exe" /f2⤵
- Creates scheduled task(s)
PID:4156
-
-
C:\Users\Admin\AppData\Local\Temp\C701.exeC:\Users\Admin\AppData\Local\Temp\C701.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696
-
C:\Users\Admin\AppData\Local\Temp\CEC2.exeC:\Users\Admin\AppData\Local\Temp\CEC2.exe1⤵
- Executes dropped EXE
PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D7DB.exeC:\Users\Admin\AppData\Local\Temp\D7DB.exe1⤵
- Executes dropped EXE
PID:2788
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2224
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3848
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4972
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4104
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:5976
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:344
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:2632
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4120
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1