Resubmissions
03-09-2021 12:16
210903-pfn3ysdac4 1003-09-2021 04:55
210903-fj6mqsfbfk 1002-09-2021 19:23
210902-x37sksbef5 1002-09-2021 15:02
210902-senycadeck 1002-09-2021 11:29
210902-4b2x2c3ahj 1002-09-2021 05:46
210902-lng5vcn31n 1002-09-2021 04:57
210902-gp7zs88ann 1001-09-2021 17:32
210901-sgcvvtysvs 1031-08-2021 12:57
210831-1v8aywj16x 1031-08-2021 07:34
210831-n7h9w45r3x 10Analysis
-
max time kernel
2705s -
max time network
2686s -
platform
windows10_x64 -
resource
win10-de -
submitted
02-09-2021 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10-jp
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10-fr
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win10-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
win10-de
General
-
Target
Setup.exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
Extracted
raccoon
7ec37c4e52b45215a7a83ab1f127b87c27384d9a
-
url4cnc
https://telete.in/bimboDinotrex
Extracted
redline
NORMAN3
45.14.49.184:28743
Extracted
redline
1
37.0.8.88:44263
Extracted
vidar
40.4
937
https://romkaxarit.tumblr.com/
-
profile_id
937
Extracted
redline
02_09_fat
185.215.113.104:18754
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
metasploit
windows/single_exec
Signatures
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral6/memory/4384-382-0x0000000003850000-0x0000000004177000-memory.dmp family_glupteba behavioral6/memory/4384-408-0x0000000000400000-0x0000000002F73000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies system executable filetype association 2 TTPs 3 IoCs
Processes:
OneDriveSetup.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerUNdlL32.eXerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5176 5940 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 5940 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 21676 5940 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 31 IoCs
Processes:
resource yara_rule behavioral6/memory/1464-260-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral6/memory/4200-264-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral6/memory/4200-268-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/4456-291-0x0000000002DC0000-0x0000000002DDF000-memory.dmp family_redline behavioral6/memory/4456-297-0x0000000004B10000-0x0000000004B2E000-memory.dmp family_redline behavioral6/memory/4200-296-0x00000000053A0000-0x00000000059A6000-memory.dmp family_redline behavioral6/memory/1464-261-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/3112-318-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/4724-322-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/3764-339-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/4976-346-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/3764-357-0x0000000005480000-0x0000000005A86000-memory.dmp family_redline behavioral6/memory/8-381-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/4868-385-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/5108-398-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/4868-418-0x0000000004D30000-0x0000000005336000-memory.dmp family_redline behavioral6/memory/5344-433-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/5480-446-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/6020-476-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/5136-493-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/5332-526-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/5496-512-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/5428-562-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/5436-577-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/5704-606-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/5092-608-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/6308-648-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/6792-663-0x000000000041C5BE-mapping.dmp family_redline behavioral6/memory/6824-664-0x000000000041C5C2-mapping.dmp family_redline behavioral6/memory/6928-680-0x000000000041C5BA-mapping.dmp family_redline behavioral6/memory/6208-707-0x000000000041C5BE-mapping.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 6044 created 4300 6044 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe PID 5668 created 4628 5668 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe PID 12132 created 10624 12132 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe PID 42928 created 756 42928 PID 19376 created 45704 19376 -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 4400 created 4208 4400 svchost.exe OneDriveSetup.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral6/memory/3200-249-0x0000000004880000-0x0000000004953000-memory.dmp family_vidar behavioral6/memory/3200-292-0x0000000000400000-0x0000000002BB0000-memory.dmp family_vidar behavioral6/memory/8-422-0x0000000005430000-0x0000000005A36000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
Processes:
lKuiU0ueue9hP7fPl7qDyVfv.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts lKuiU0ueue9hP7fPl7qDyVfv.exe File opened for modification C:\Windows\System32\drivers\SETE301.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETE301.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe -
Executes dropped EXE 64 IoCs
Processes:
FileSyncConfig.exeJGFgZLxOEyV2E26ohxEMtbxq.exeeg_zvbLuJAN4zm370uVh1QI2.exekRexbEtzPQ3A2qnNCXpxEva7.exeHOsbP4Z18so2RCYTJmdWOsmg.exeCGBwSwhP0CTIbdfJ0wid9VWG.exesIPgivvw6w2EUcxZtACYvmll.exegPeWjY1N0dsGDonI8jn8DfZ4.exeszhhHmrxnbLce7zuA3EXFdwa.exevbGHm45kjCDl688_Qzqx3MlD.exeZJNBtcQZzuwgFHceV64gW0GZ.exettSEA85SCFlhANAavfQZbLeF.exeJ6cfVSeVTdEx4B9pPHOnOVjL.exedlCXSJBy50tpXlBhY_AH26sH.exeeadgalboaW0LQtFB44FNjP7k.exeD8IDpZtlMsjDjKITc3nHwzpr.exelKuiU0ueue9hP7fPl7qDyVfv.exeYvNBafQA1Kxd6pgOyi4a_mSA.exeGweJ4RP2BihDlJC6dU_cMShM.exe5k0P7XCWBxOyZivL1lGy90jO.exeinst001.executm3.exe5k0P7XCWBxOyZivL1lGy90jO.tmpmd8_8eus.exekRexbEtzPQ3A2qnNCXpxEva7.exeeadgalboaW0LQtFB44FNjP7k.exesIPgivvw6w2EUcxZtACYvmll.exeHOsbP4Z18so2RCYTJmdWOsmg.exeWerFault.exeszhhHmrxnbLce7zuA3EXFdwa.exeszhhHmrxnbLce7zuA3EXFdwa.exeHOsbP4Z18so2RCYTJmdWOsmg.exeszhhHmrxnbLce7zuA3EXFdwa.exesIPgivvw6w2EUcxZtACYvmll.exe2385251.exeHOsbP4Z18so2RCYTJmdWOsmg.exeHOsbP4Z18so2RCYTJmdWOsmg.exe8605373.exe1608988.exesIPgivvw6w2EUcxZtACYvmll.exeszhhHmrxnbLce7zuA3EXFdwa.exeHOsbP4Z18so2RCYTJmdWOsmg.exeJ77cmUgJX0OQi4nZtiqUPG2L.exeHOsbP4Z18so2RCYTJmdWOsmg.exeszhhHmrxnbLce7zuA3EXFdwa.exeHOsbP4Z18so2RCYTJmdWOsmg.exesIPgivvw6w2EUcxZtACYvmll.exeWinHoster.exeszhhHmrxnbLce7zuA3EXFdwa.exeHOsbP4Z18so2RCYTJmdWOsmg.exesIPgivvw6w2EUcxZtACYvmll.exeszhhHmrxnbLce7zuA3EXFdwa.execmd.exesIPgivvw6w2EUcxZtACYvmll.exeWerFault.exeHOsbP4Z18so2RCYTJmdWOsmg.exesIPgivvw6w2EUcxZtACYvmll.exeszhhHmrxnbLce7zuA3EXFdwa.exesIPgivvw6w2EUcxZtACYvmll.exeHOsbP4Z18so2RCYTJmdWOsmg.exeszhhHmrxnbLce7zuA3EXFdwa.exesIPgivvw6w2EUcxZtACYvmll.exeHOsbP4Z18so2RCYTJmdWOsmg.exepid process 4656 FileSyncConfig.exe 4376 JGFgZLxOEyV2E26ohxEMtbxq.exe 4384 eg_zvbLuJAN4zm370uVh1QI2.exe 2948 kRexbEtzPQ3A2qnNCXpxEva7.exe 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe 4336 CGBwSwhP0CTIbdfJ0wid9VWG.exe 4312 sIPgivvw6w2EUcxZtACYvmll.exe 4628 gPeWjY1N0dsGDonI8jn8DfZ4.exe 4192 szhhHmrxnbLce7zuA3EXFdwa.exe 4048 vbGHm45kjCDl688_Qzqx3MlD.exe 3052 ZJNBtcQZzuwgFHceV64gW0GZ.exe 4668 ttSEA85SCFlhANAavfQZbLeF.exe 4732 J6cfVSeVTdEx4B9pPHOnOVjL.exe 4456 dlCXSJBy50tpXlBhY_AH26sH.exe 4268 eadgalboaW0LQtFB44FNjP7k.exe 4300 D8IDpZtlMsjDjKITc3nHwzpr.exe 4616 lKuiU0ueue9hP7fPl7qDyVfv.exe 3200 YvNBafQA1Kxd6pgOyi4a_mSA.exe 4936 GweJ4RP2BihDlJC6dU_cMShM.exe 5060 5k0P7XCWBxOyZivL1lGy90jO.exe 5068 inst001.exe 4348 cutm3.exe 2996 5k0P7XCWBxOyZivL1lGy90jO.tmp 3932 md8_8eus.exe 4644 kRexbEtzPQ3A2qnNCXpxEva7.exe 4776 eadgalboaW0LQtFB44FNjP7k.exe 1464 sIPgivvw6w2EUcxZtACYvmll.exe 4200 HOsbP4Z18so2RCYTJmdWOsmg.exe 1616 WerFault.exe 4752 szhhHmrxnbLce7zuA3EXFdwa.exe 3112 szhhHmrxnbLce7zuA3EXFdwa.exe 4724 HOsbP4Z18so2RCYTJmdWOsmg.exe 3764 szhhHmrxnbLce7zuA3EXFdwa.exe 4976 sIPgivvw6w2EUcxZtACYvmll.exe 2124 2385251.exe 2136 HOsbP4Z18so2RCYTJmdWOsmg.exe 4116 HOsbP4Z18so2RCYTJmdWOsmg.exe 4760 8605373.exe 5164 1608988.exe 8 sIPgivvw6w2EUcxZtACYvmll.exe 4868 szhhHmrxnbLce7zuA3EXFdwa.exe 5108 HOsbP4Z18so2RCYTJmdWOsmg.exe 5748 J77cmUgJX0OQi4nZtiqUPG2L.exe 5332 HOsbP4Z18so2RCYTJmdWOsmg.exe 5344 szhhHmrxnbLce7zuA3EXFdwa.exe 5480 HOsbP4Z18so2RCYTJmdWOsmg.exe 5876 sIPgivvw6w2EUcxZtACYvmll.exe 2732 WinHoster.exe 6020 szhhHmrxnbLce7zuA3EXFdwa.exe 5136 HOsbP4Z18so2RCYTJmdWOsmg.exe 5192 sIPgivvw6w2EUcxZtACYvmll.exe 5496 szhhHmrxnbLce7zuA3EXFdwa.exe 5388 cmd.exe 5332 HOsbP4Z18so2RCYTJmdWOsmg.exe 5888 sIPgivvw6w2EUcxZtACYvmll.exe 5244 WerFault.exe 6124 HOsbP4Z18so2RCYTJmdWOsmg.exe 5428 sIPgivvw6w2EUcxZtACYvmll.exe 5436 szhhHmrxnbLce7zuA3EXFdwa.exe 5704 sIPgivvw6w2EUcxZtACYvmll.exe 5092 HOsbP4Z18so2RCYTJmdWOsmg.exe 5328 szhhHmrxnbLce7zuA3EXFdwa.exe 6308 sIPgivvw6w2EUcxZtACYvmll.exe 6368 HOsbP4Z18so2RCYTJmdWOsmg.exe -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
7OaahdL3Glrn9GMAwUe1cxEu.exeRANAHrYfewyREYwy7HURW9L3.exe78C8.exettSEA85SCFlhANAavfQZbLeF.exeCGBwSwhP0CTIbdfJ0wid9VWG.exeF0C9.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7OaahdL3Glrn9GMAwUe1cxEu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RANAHrYfewyREYwy7HURW9L3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 78C8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 78C8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ttSEA85SCFlhANAavfQZbLeF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CGBwSwhP0CTIbdfJ0wid9VWG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7OaahdL3Glrn9GMAwUe1cxEu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RANAHrYfewyREYwy7HURW9L3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion F0C9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion F0C9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ttSEA85SCFlhANAavfQZbLeF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CGBwSwhP0CTIbdfJ0wid9VWG.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup.execmd.exeJ77cmUgJX0OQi4nZtiqUPG2L.exeSetup.exeJ77cmUgJX0OQi4nZtiqUPG2L.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation J77cmUgJX0OQi4nZtiqUPG2L.exe Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation J77cmUgJX0OQi4nZtiqUPG2L.exe -
Loads dropped DLL 49 IoCs
Processes:
FileSyncConfig.exe5k0P7XCWBxOyZivL1lGy90jO.tmpJ6cfVSeVTdEx4B9pPHOnOVjL.exerundll32.exeVPN.tmpszhhHmrxnbLce7zuA3EXFdwa.exeYvNBafQA1Kxd6pgOyi4a_mSA.exeSetup.tmprundll32.exeu6amjGimhBlN8BglJw9gutH_.tmpwgI8nnLLoARa0hpW0v13g39m.exesIPgivvw6w2EUcxZtACYvmll.exerundll32.exemask_svc.exeF30.exeMaskVPNUpdate.exepid process 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 4656 FileSyncConfig.exe 2996 5k0P7XCWBxOyZivL1lGy90jO.tmp 2996 5k0P7XCWBxOyZivL1lGy90jO.tmp 4732 J6cfVSeVTdEx4B9pPHOnOVjL.exe 4712 rundll32.exe 6472 VPN.tmp 6472 VPN.tmp 7180 szhhHmrxnbLce7zuA3EXFdwa.exe 7180 szhhHmrxnbLce7zuA3EXFdwa.exe 3200 YvNBafQA1Kxd6pgOyi4a_mSA.exe 3200 YvNBafQA1Kxd6pgOyi4a_mSA.exe 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 2800 rundll32.exe 12396 u6amjGimhBlN8BglJw9gutH_.tmp 12396 u6amjGimhBlN8BglJw9gutH_.tmp 9016 wgI8nnLLoARa0hpW0v13g39m.exe 9016 wgI8nnLLoARa0hpW0v13g39m.exe 11060 sIPgivvw6w2EUcxZtACYvmll.exe 11060 sIPgivvw6w2EUcxZtACYvmll.exe 24456 rundll32.exe 25528 mask_svc.exe 25528 mask_svc.exe 8940 8940 25528 mask_svc.exe 25528 mask_svc.exe 25528 mask_svc.exe 25528 mask_svc.exe 27484 F30.exe 27484 F30.exe 27484 F30.exe 27484 F30.exe 27484 F30.exe 29180 MaskVPNUpdate.exe 29180 MaskVPNUpdate.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\CGBwSwhP0CTIbdfJ0wid9VWG.exe themida C:\Users\Admin\Documents\ttSEA85SCFlhANAavfQZbLeF.exe themida C:\Users\Admin\Documents\CGBwSwhP0CTIbdfJ0wid9VWG.exe themida C:\Users\Admin\Documents\ttSEA85SCFlhANAavfQZbLeF.exe themida behavioral6/memory/4668-242-0x0000000000B40000-0x0000000000B41000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
OneDriveSetup.exeHOsbP4Z18so2RCYTJmdWOsmg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" HOsbP4Z18so2RCYTJmdWOsmg.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\services.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\services.exe\" -start" -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
F0C9.exettSEA85SCFlhANAavfQZbLeF.exeCGBwSwhP0CTIbdfJ0wid9VWG.exemd8_8eus.exe7OaahdL3Glrn9GMAwUe1cxEu.exeRANAHrYfewyREYwy7HURW9L3.exe78C8.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F0C9.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ttSEA85SCFlhANAavfQZbLeF.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CGBwSwhP0CTIbdfJ0wid9VWG.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7OaahdL3Glrn9GMAwUe1cxEu.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RANAHrYfewyREYwy7HURW9L3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 78C8.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
services.exedescription ioc process File opened (read-only) \??\W: services.exe File opened (read-only) \??\S: services.exe File opened (read-only) \??\N: services.exe File opened (read-only) \??\L: services.exe File opened (read-only) \??\H: services.exe File opened (read-only) \??\G: services.exe File opened (read-only) \??\Q: services.exe File opened (read-only) \??\I: services.exe File opened (read-only) \??\B: services.exe File opened (read-only) \??\A: services.exe File opened (read-only) \??\Z: services.exe File opened (read-only) \??\Y: services.exe File opened (read-only) \??\U: services.exe File opened (read-only) \??\T: services.exe File opened (read-only) \??\O: services.exe File opened (read-only) \??\M: services.exe File opened (read-only) \??\X: services.exe File opened (read-only) \??\V: services.exe File opened (read-only) \??\R: services.exe File opened (read-only) \??\P: services.exe File opened (read-only) \??\K: services.exe File opened (read-only) \??\J: services.exe File opened (read-only) \??\F: services.exe File opened (read-only) \??\E: services.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 20 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 797 ipinfo.io 1366 ipinfo.io 6425 geoiptool.com 138 ipinfo.io 221 ipinfo.io 332 ipinfo.io 531 ipinfo.io 1134 ip-api.com 141 ip-api.com 222 ipinfo.io 336 ipinfo.io 342 ipinfo.io 532 ipinfo.io 796 ipinfo.io 23 ipinfo.io 46 ipinfo.io 137 ipinfo.io 164 ipinfo.io 1190 ipinfo.io 1199 ipinfo.io -
Drops file in System32 directory 27 IoCs
Processes:
svchost.exeDrvInst.exesvchost.exesvchost32.exetapinstall.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\SETC98D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\SETC99F.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\SETC99F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\SETC99E.tmp DrvInst.exe File opened for modification C:\Windows\System32\Tasks\services32 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\system32\services32.exe svchost32.exe File created C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\SETC99E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat File created C:\Windows\system32\services32.exe svchost32.exe File opened for modification C:\Windows\System32\Tasks\PowerControl LG svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent B92F9EC55CBAF372 svchost.exe File created C:\Windows\System32\DriverStore\Temp\{073c3f79-98d3-0c44-9539-5d14ab044574}\SETC98D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\System32\Tasks\PowerControl HR svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
ttSEA85SCFlhANAavfQZbLeF.exeCGBwSwhP0CTIbdfJ0wid9VWG.exe7OaahdL3Glrn9GMAwUe1cxEu.exeRANAHrYfewyREYwy7HURW9L3.exesIPgivvw6w2EUcxZtACYvmll.exemask_svc.exemask_svc.exe78C8.exeF0C9.exepid process 4668 ttSEA85SCFlhANAavfQZbLeF.exe 4336 CGBwSwhP0CTIbdfJ0wid9VWG.exe 2064 7OaahdL3Glrn9GMAwUe1cxEu.exe 12552 RANAHrYfewyREYwy7HURW9L3.exe 25456 sIPgivvw6w2EUcxZtACYvmll.exe 26108 mask_svc.exe 25528 mask_svc.exe 28236 78C8.exe 29080 F0C9.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
kRexbEtzPQ3A2qnNCXpxEva7.exesIPgivvw6w2EUcxZtACYvmll.exeHOsbP4Z18so2RCYTJmdWOsmg.exeszhhHmrxnbLce7zuA3EXFdwa.exesvchost.exedescription pid process target process PID 2948 set thread context of 4644 2948 kRexbEtzPQ3A2qnNCXpxEva7.exe kRexbEtzPQ3A2qnNCXpxEva7.exe PID 4312 set thread context of 1464 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 4200 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 3112 4312 sIPgivvw6w2EUcxZtACYvmll.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 4724 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 3764 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 4312 set thread context of 4976 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4312 set thread context of 8 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 4868 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 5108 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 5344 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 5480 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 6020 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 5136 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 5496 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 5332 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 3636 set thread context of 3828 3636 svchost.exe svchost.exe PID 4312 set thread context of 5428 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 5436 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 4312 set thread context of 5704 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 5092 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 6308 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 6792 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 6824 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 6928 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 6208 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 6404 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 4312 set thread context of 4600 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 6844 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 6896 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 7152 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 6148 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 4312 set thread context of 6988 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 6592 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 4312 set thread context of 7276 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 7500 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 7528 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 4312 set thread context of 7744 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 7904 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 8164 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 7436 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 7548 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 4848 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 8120 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4192 set thread context of 5568 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 7720 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 7188 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 5820 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 7868 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 5936 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 8280 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 8488 4312 sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 8824 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 9112 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 7584 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 8604 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 9036 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 4360 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 8892 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 9020 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 2944 set thread context of 3344 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 4312 set thread context of 6480 4312 sIPgivvw6w2EUcxZtACYvmll.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 4192 set thread context of 8508 4192 szhhHmrxnbLce7zuA3EXFdwa.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 2944 set thread context of 9104 2944 HOsbP4Z18so2RCYTJmdWOsmg.exe HOsbP4Z18so2RCYTJmdWOsmg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
description ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe.payfast.36A-1C8-688 File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveDrop32x32.gif File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\error-icon.png.payfast.36A-1C8-688 File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js.payfast.36A-1C8-688 File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-white.png File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\fo_60x42.png File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\logo.png File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-150.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_multi_filetype.svg.payfast.36A-1C8-688 File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js.payfast.36A-1C8-688 File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\THMBNAIL.PNG File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-96.png File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\Dismiss.scale-64.png File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-400.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\ui-strings.js.payfast.36A-1C8-688 File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\ui-strings.js.payfast.36A-1C8-688 File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.payfast.36A-1C8-688 File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.payfast.36A-1C8-688 File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\mask\12h.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected-hover.svg File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-36_altform-fullcolor.png File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\TurnByTurn.png File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\_Resources\0.rsrc File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\bb_16x11.png File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\976_48x48x32.png File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Builder3D.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-150.png File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\3RDPARTY.payfast.36A-1C8-688 File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar File created C:\Program Files\Java\jre1.8.0_66\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-125.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js.payfast.36A-1C8-688 File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_18.svg.payfast.36A-1C8-688 File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\challenge\Gimme_Five_Unearned_small.png File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Backgrounds\Background2.png File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\zw_60x42.png File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-250.png File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\0.jpg File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js.payfast.36A-1C8-688 File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\wfh.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js.payfast.36A-1C8-688 File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.payfast.36A-1C8-688 File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\en-us\outlook_whatsnew.xml File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\SmallTile.scale-200.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png.payfast.36A-1C8-688 File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT -
Drops file in Windows directory 12 IoCs
Processes:
DrvInst.exeDrvInst.exeMicrosoftEdge.exetapinstall.exedescription ioc process File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\rescache\_merged\2717123927\1713683155.pri File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File created C:\Windows\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT File created C:\Windows\rescache\_merged\3720402701\2274612954.pri File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1616 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 4856 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 4484 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 4960 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 3444 3112 WerFault.exe sIPgivvw6w2EUcxZtACYvmll.exe 3988 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 2960 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 2020 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 2084 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 6128 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 5512 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 4936 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 6016 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 6044 4300 WerFault.exe D8IDpZtlMsjDjKITc3nHwzpr.exe 5132 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 4980 4732 WerFault.exe J6cfVSeVTdEx4B9pPHOnOVjL.exe 6132 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 5244 5428 WerFault.exe sIPgivvw6w2EUcxZtACYvmll.exe 5668 4628 WerFault.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe 6376 5092 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 6848 6308 WerFault.exe sIPgivvw6w2EUcxZtACYvmll.exe 6852 6208 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 7344 6988 WerFault.exe sIPgivvw6w2EUcxZtACYvmll.exe 8272 5820 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 10748 8104 WerFault.exe sIPgivvw6w2EUcxZtACYvmll.exe 10404 5384 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 11820 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 12096 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 11536 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 12312 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 13496 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 13624 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 11500 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 14664 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 12880 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 12132 10624 WerFault.exe FHjDMKWxZ3fD1y36Gdk09a2j.exe 15448 14168 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 15592 16028 WerFault.exe szhhHmrxnbLce7zuA3EXFdwa.exe 14688 16340 WerFault.exe n4gBqi632Yk0rFFLMZZeHMiT.exe 17724 17044 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 16828 18384 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 12004 18120 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 18144 17964 WerFault.exe szhhHmrxnbLce7zuA3EXFdwa.exe 21188 16764 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 17252 25124 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 17812 21088 WerFault.exe szhhHmrxnbLce7zuA3EXFdwa.exe 25824 24228 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 27660 27720 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 24524 9708 WerFault.exe PvRrvi06R4pVostcilHJONbS.exe 24816 27872 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 28996 27532 WerFault.exe PvRrvi06R4pVostcilHJONbS.exe 27376 31288 WerFault.exe PvRrvi06R4pVostcilHJONbS.exe 31332 31556 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 31176 22192 WerFault.exe HOsbP4Z18so2RCYTJmdWOsmg.exe 6112 35212 30764 33572 35452 34788 39772 36896 6504 40420 32584 41248 44080 45468 41048 29352 szhhHmrxnbLce7zuA3EXFdwa.exe 45956 43260 46212 46736 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
kRexbEtzPQ3A2qnNCXpxEva7.exeDrvInst.exesvchost.exetapinstall.exetapinstall.exeDrvInst.exeEMBE79WkMdkxF2V2eJOCkXsQ.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI kRexbEtzPQ3A2qnNCXpxEva7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EMBE79WkMdkxF2V2eJOCkXsQ.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe -
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wgI8nnLLoARa0hpW0v13g39m.exewmiprvse.exesvchost.exeYvNBafQA1Kxd6pgOyi4a_mSA.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wgI8nnLLoARa0hpW0v13g39m.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 YvNBafQA1Kxd6pgOyi4a_mSA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString YvNBafQA1Kxd6pgOyi4a_mSA.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wgI8nnLLoARa0hpW0v13g39m.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wmiprvse.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5776 schtasks.exe 5812 schtasks.exe 8564 schtasks.exe 12924 schtasks.exe 11368 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exepid process 12724 timeout.exe 31300 -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 12468 taskkill.exe 12524 taskkill.exe 10884 taskkill.exe 11588 taskkill.exe 14600 taskkill.exe 8376 taskkill.exe 12084 taskkill.exe -
Processes:
OneDriveSetup.exeIEXPLORE.EXEMicrosoftEdge.exebrowser_broker.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7007dba731a0d701 Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30908465" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3209673857" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEA34432-0C24-11EC-A249-6E8E477EF7FE} = "0" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\de-DE = "de-DE.1" Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3209986574" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3128892409" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30908465" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "337393586" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ee76a731a0d701 Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30908465" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d461000000000200000000001066000000010000200000003b784e6c648ca2d065b1c9b8b7bfa6d192d4b3329b8359ebdf006ab1f01ede13000000000e800000000200002000000005be0d800072f88185af08310900e23b69c223be72089a91cfbf7d8a4736ca9220000000aa3f8a813fbfee7a99f64e5327f0742c48fdcddc47ac028c1cd0acb182cb1c0340000000dbc1d7a420e1be39429ec7c939f06d33f6d1a64755e9345522a16d6225c5da1e3314176e17df129487690b5cf4f2f43cb8bd9582b02ef79b4da1a63a6a5a7011 Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a26c0d15bae564eb8f5d9426257d46100000000020000000000106600000001000020000000c670441e066041612fa32b0a6056043b6edebfc91b3e9d2f47862dbef43ebf92000000000e80000000020000200000000386e0d6f3a2e816e54914caf0f61a253fb5cd2a36485574e94e032d2aad11f520000000c47a96d5b8f11a4d5f29eed1259edbad71e39f7795f0d97d2e1c87311e3ece2c400000004bbe672a92a4ddcb9aaddc41d0771e09e5bf4949103d372b896f3fcdad4c1a1935e7335f8e5f2260fc8092f95b1bab4c49ecaba3652eb49a476fbf0d57f884b4 Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30908465" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "337425507" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3128892409" Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337376255" -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mask_svc.exesvchost.exeDrvInst.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" mask_svc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs mask_svc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" mask_svc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" mask_svc.exe -
Modifies registry class 64 IoCs
Processes:
OneDriveSetup.exeMicrosoftEdge.exesvchost.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{C1439245-96B4-47FC-B391-679386C5D40F}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\INPROCSERVER32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\VERSIONINDEPENDENTPROGID OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\ProgID\ = "NucleusToastActivator.NucleusToastActivator.1" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{F0440F4E-4884-4A8F-8A45-BA89C00F96F2}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TYPELIB OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\ = "IDeleteLibraryCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\0 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\.fluid OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LOCALSERVER32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\FILESYNCCLIENT.FILESYNCCLIENT\CURVER OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\ = "ICreateLibraryCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileSyncShell.dll" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{B5C25645-7426-433F-8A5F-42B7FF27A7B2}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{E9DE26A1-51B2-47B4-B1BF-C87059CC02A7}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\amd64\\FileSyncShell64.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib\Version = "1.0" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\AppID\{EEABD3A3-784D-4334-AAFC-BB13234F17CF} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{DA82E55E-FA2F-45B3-AEC3-E7294106EF52}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\grvopen\shell\open OneDriveSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{LJDG576V-FJ1Y-M3DK-T0ZJ-KIMQL256VU13} svchost.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\INPROCSERVER32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ = "ISetSelectiveSyncInformationCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}" OneDriveSetup.exe -
Processes:
Setup.exeSetup.tmptapinstall.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC Setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f Setup.tmp -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 4564 notepad.exe -
Script User-Agent 21 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 159 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 164 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 171 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 248 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 333 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 377 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1325 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1782 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 350 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1366 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 192 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 199 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1609 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1947 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 154 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 336 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 340 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 342 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 345 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1477 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1816 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
OneDriveSetup.exeOneDriveSetup.exeSetup.exeJ6cfVSeVTdEx4B9pPHOnOVjL.exekRexbEtzPQ3A2qnNCXpxEva7.exeWerFault.exeWerFault.exepid process 4208 OneDriveSetup.exe 4208 OneDriveSetup.exe 4208 OneDriveSetup.exe 4208 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 4428 OneDriveSetup.exe 3904 Setup.exe 3904 Setup.exe 4732 J6cfVSeVTdEx4B9pPHOnOVjL.exe 4732 J6cfVSeVTdEx4B9pPHOnOVjL.exe 4732 J6cfVSeVTdEx4B9pPHOnOVjL.exe 4732 J6cfVSeVTdEx4B9pPHOnOVjL.exe 4644 kRexbEtzPQ3A2qnNCXpxEva7.exe 4644 kRexbEtzPQ3A2qnNCXpxEva7.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4960 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2108 -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid process 26036 21988 32072 43260 39356 46796 45200 32704 16720 41060 27300 43972 28700 16000 37232 34180 43464 45380 33852 19252 27612 44504 15128 46136 18016 39920 10912 46504 37136 26592 10020 14724 25432 16904 46388 36184 1272 42436 6712 13260 16796 33012 35856 3996 6076 45112 32724 43776 31100 43136 35288 26392 30388 34232 38072 27412 5412 24432 13924 30876 43656 44692 13992 1468 -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
kRexbEtzPQ3A2qnNCXpxEva7.exeEMBE79WkMdkxF2V2eJOCkXsQ.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 4644 kRexbEtzPQ3A2qnNCXpxEva7.exe 12088 EMBE79WkMdkxF2V2eJOCkXsQ.exe 2108 2108 2108 2108 2108 2108 26988 26988 2108 2108 29500 explorer.exe 29500 explorer.exe 29500 explorer.exe 29500 explorer.exe 2108 2108 16780 explorer.exe 16780 explorer.exe 29500 explorer.exe 29500 explorer.exe 2108 2108 29500 explorer.exe 29500 explorer.exe 29596 explorer.exe 29596 explorer.exe 29500 explorer.exe 29500 explorer.exe 2108 2108 29500 explorer.exe 29596 explorer.exe 29596 explorer.exe 29500 explorer.exe 29596 explorer.exe 29596 explorer.exe 29748 29748 2108 2108 29596 explorer.exe 29596 explorer.exe 30700 explorer.exe 30700 explorer.exe 29596 explorer.exe 29596 explorer.exe 2108 2108 29596 explorer.exe 29596 explorer.exe 29596 explorer.exe 29596 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe 30700 explorer.exe -
Suspicious behavior: SetClipboardViewer 5 IoCs
Processes:
5043000.exe4791552.exe1145138.exe4852999.exe3842270.exepid process 4496 5043000.exe 6604 4791552.exe 11496 1145138.exe 13428 4852999.exe 14720 3842270.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
OneDriveSetup.exesvchost.exeJGFgZLxOEyV2E26ohxEMtbxq.exeWerFault.exelKuiU0ueue9hP7fPl7qDyVfv.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exettSEA85SCFlhANAavfQZbLeF.exe1608988.exe2385251.exesIPgivvw6w2EUcxZtACYvmll.exedlCXSJBy50tpXlBhY_AH26sH.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exerundll32.exesvchost.exeWerFault.exeWerFault.exedescription pid process Token: SeIncreaseQuotaPrivilege 4208 OneDriveSetup.exe Token: SeTcbPrivilege 4400 svchost.exe Token: SeTcbPrivilege 4400 svchost.exe Token: SeDebugPrivilege 4376 JGFgZLxOEyV2E26ohxEMtbxq.exe Token: SeRestorePrivilege 4484 WerFault.exe Token: SeBackupPrivilege 4484 WerFault.exe Token: SeDebugPrivilege 4616 lKuiU0ueue9hP7fPl7qDyVfv.exe Token: SeDebugPrivilege 4960 WerFault.exe Token: SeDebugPrivilege 4484 WerFault.exe Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeDebugPrivilege 1616 WerFault.exe Token: SeDebugPrivilege 4856 WerFault.exe Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeDebugPrivilege 2960 WerFault.exe Token: SeDebugPrivilege 3988 WerFault.exe Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeDebugPrivilege 2020 WerFault.exe Token: SeDebugPrivilege 2084 WerFault.exe Token: SeDebugPrivilege 4668 ttSEA85SCFlhANAavfQZbLeF.exe Token: SeDebugPrivilege 5164 1608988.exe Token: SeDebugPrivilege 2124 2385251.exe Token: SeDebugPrivilege 1464 sIPgivvw6w2EUcxZtACYvmll.exe Token: SeDebugPrivilege 4456 dlCXSJBy50tpXlBhY_AH26sH.exe Token: SeDebugPrivilege 6128 WerFault.exe Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeDebugPrivilege 5512 WerFault.exe Token: SeDebugPrivilege 4936 WerFault.exe Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeDebugPrivilege 5132 WerFault.exe Token: SeShutdownPrivilege 2108 Token: SeCreatePagefilePrivilege 2108 Token: SeDebugPrivilege 6044 WerFault.exe Token: SeDebugPrivilege 4712 rundll32.exe Token: SeDebugPrivilege 3636 svchost.exe Token: SeDebugPrivilege 4712 rundll32.exe Token: SeDebugPrivilege 4712 rundll32.exe Token: SeDebugPrivilege 4712 rundll32.exe Token: SeDebugPrivilege 4712 rundll32.exe Token: SeDebugPrivilege 4980 WerFault.exe Token: SeDebugPrivilege 6132 WerFault.exe Token: SeDebugPrivilege 4712 rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
5k0P7XCWBxOyZivL1lGy90jO.tmpVPN.tmpszhhHmrxnbLce7zuA3EXFdwa.exeSetup.tmppid process 2996 5k0P7XCWBxOyZivL1lGy90jO.tmp 2108 2108 6472 VPN.tmp 7180 szhhHmrxnbLce7zuA3EXFdwa.exe 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp 8940 Setup.tmp -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 2108 2108 2108 2108 2108 2108 -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeIEXPLORE.EXEOpenWith.exe9DB6.exeMaskVPNUpdate.exepid process 2108 7056 MicrosoftEdge.exe 7676 MicrosoftEdgeCP.exe 11620 11620 10772 IEXPLORE.EXE 10772 IEXPLORE.EXE 4796 880 OpenWith.exe 25988 9DB6.exe 29180 MaskVPNUpdate.exe 2108 2108 -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
pid process 35124 34856 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
svchost.exeOneDriveSetup.exeSetup.exeZJNBtcQZzuwgFHceV64gW0GZ.exedescription pid process target process PID 4400 wrote to memory of 4428 4400 svchost.exe OneDriveSetup.exe PID 4400 wrote to memory of 4428 4400 svchost.exe OneDriveSetup.exe PID 4400 wrote to memory of 4428 4400 svchost.exe OneDriveSetup.exe PID 4428 wrote to memory of 4656 4428 OneDriveSetup.exe FileSyncConfig.exe PID 4428 wrote to memory of 4656 4428 OneDriveSetup.exe FileSyncConfig.exe PID 4428 wrote to memory of 4656 4428 OneDriveSetup.exe FileSyncConfig.exe PID 3904 wrote to memory of 4376 3904 Setup.exe JGFgZLxOEyV2E26ohxEMtbxq.exe PID 3904 wrote to memory of 4376 3904 Setup.exe JGFgZLxOEyV2E26ohxEMtbxq.exe PID 3904 wrote to memory of 2948 3904 Setup.exe kRexbEtzPQ3A2qnNCXpxEva7.exe PID 3904 wrote to memory of 2948 3904 Setup.exe kRexbEtzPQ3A2qnNCXpxEva7.exe PID 3904 wrote to memory of 2948 3904 Setup.exe kRexbEtzPQ3A2qnNCXpxEva7.exe PID 3904 wrote to memory of 4384 3904 Setup.exe eg_zvbLuJAN4zm370uVh1QI2.exe PID 3904 wrote to memory of 4384 3904 Setup.exe eg_zvbLuJAN4zm370uVh1QI2.exe PID 3904 wrote to memory of 4384 3904 Setup.exe eg_zvbLuJAN4zm370uVh1QI2.exe PID 3904 wrote to memory of 2944 3904 Setup.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 3904 wrote to memory of 2944 3904 Setup.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 3904 wrote to memory of 2944 3904 Setup.exe HOsbP4Z18so2RCYTJmdWOsmg.exe PID 3904 wrote to memory of 4336 3904 Setup.exe CGBwSwhP0CTIbdfJ0wid9VWG.exe PID 3904 wrote to memory of 4336 3904 Setup.exe CGBwSwhP0CTIbdfJ0wid9VWG.exe PID 3904 wrote to memory of 4336 3904 Setup.exe CGBwSwhP0CTIbdfJ0wid9VWG.exe PID 3904 wrote to memory of 4312 3904 Setup.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 3904 wrote to memory of 4312 3904 Setup.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 3904 wrote to memory of 4312 3904 Setup.exe sIPgivvw6w2EUcxZtACYvmll.exe PID 3904 wrote to memory of 4628 3904 Setup.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe PID 3904 wrote to memory of 4628 3904 Setup.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe PID 3904 wrote to memory of 4628 3904 Setup.exe gPeWjY1N0dsGDonI8jn8DfZ4.exe PID 3904 wrote to memory of 4048 3904 Setup.exe vbGHm45kjCDl688_Qzqx3MlD.exe PID 3904 wrote to memory of 4048 3904 Setup.exe vbGHm45kjCDl688_Qzqx3MlD.exe PID 3904 wrote to memory of 4192 3904 Setup.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 3904 wrote to memory of 4192 3904 Setup.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 3904 wrote to memory of 4192 3904 Setup.exe szhhHmrxnbLce7zuA3EXFdwa.exe PID 3904 wrote to memory of 3052 3904 Setup.exe ZJNBtcQZzuwgFHceV64gW0GZ.exe PID 3904 wrote to memory of 3052 3904 Setup.exe ZJNBtcQZzuwgFHceV64gW0GZ.exe PID 3904 wrote to memory of 3052 3904 Setup.exe ZJNBtcQZzuwgFHceV64gW0GZ.exe PID 3904 wrote to memory of 4668 3904 Setup.exe ttSEA85SCFlhANAavfQZbLeF.exe PID 3904 wrote to memory of 4668 3904 Setup.exe ttSEA85SCFlhANAavfQZbLeF.exe PID 3904 wrote to memory of 4668 3904 Setup.exe ttSEA85SCFlhANAavfQZbLeF.exe PID 3904 wrote to memory of 4732 3904 Setup.exe J6cfVSeVTdEx4B9pPHOnOVjL.exe PID 3904 wrote to memory of 4732 3904 Setup.exe J6cfVSeVTdEx4B9pPHOnOVjL.exe PID 3904 wrote to memory of 4732 3904 Setup.exe J6cfVSeVTdEx4B9pPHOnOVjL.exe PID 3904 wrote to memory of 4456 3904 Setup.exe dlCXSJBy50tpXlBhY_AH26sH.exe PID 3904 wrote to memory of 4456 3904 Setup.exe dlCXSJBy50tpXlBhY_AH26sH.exe PID 3904 wrote to memory of 4456 3904 Setup.exe dlCXSJBy50tpXlBhY_AH26sH.exe PID 3904 wrote to memory of 4268 3904 Setup.exe eadgalboaW0LQtFB44FNjP7k.exe PID 3904 wrote to memory of 4268 3904 Setup.exe eadgalboaW0LQtFB44FNjP7k.exe PID 3904 wrote to memory of 4268 3904 Setup.exe eadgalboaW0LQtFB44FNjP7k.exe PID 3904 wrote to memory of 4300 3904 Setup.exe D8IDpZtlMsjDjKITc3nHwzpr.exe PID 3904 wrote to memory of 4300 3904 Setup.exe D8IDpZtlMsjDjKITc3nHwzpr.exe PID 3904 wrote to memory of 4300 3904 Setup.exe D8IDpZtlMsjDjKITc3nHwzpr.exe PID 3904 wrote to memory of 4616 3904 Setup.exe lKuiU0ueue9hP7fPl7qDyVfv.exe PID 3904 wrote to memory of 4616 3904 Setup.exe lKuiU0ueue9hP7fPl7qDyVfv.exe PID 3904 wrote to memory of 4616 3904 Setup.exe lKuiU0ueue9hP7fPl7qDyVfv.exe PID 3904 wrote to memory of 3200 3904 Setup.exe YvNBafQA1Kxd6pgOyi4a_mSA.exe PID 3904 wrote to memory of 3200 3904 Setup.exe YvNBafQA1Kxd6pgOyi4a_mSA.exe PID 3904 wrote to memory of 3200 3904 Setup.exe YvNBafQA1Kxd6pgOyi4a_mSA.exe PID 3904 wrote to memory of 4936 3904 Setup.exe GweJ4RP2BihDlJC6dU_cMShM.exe PID 3904 wrote to memory of 4936 3904 Setup.exe GweJ4RP2BihDlJC6dU_cMShM.exe PID 3904 wrote to memory of 4936 3904 Setup.exe GweJ4RP2BihDlJC6dU_cMShM.exe PID 3904 wrote to memory of 5060 3904 Setup.exe 5k0P7XCWBxOyZivL1lGy90jO.exe PID 3904 wrote to memory of 5060 3904 Setup.exe 5k0P7XCWBxOyZivL1lGy90jO.exe PID 3904 wrote to memory of 5060 3904 Setup.exe 5k0P7XCWBxOyZivL1lGy90jO.exe PID 3052 wrote to memory of 5068 3052 ZJNBtcQZzuwgFHceV64gW0GZ.exe inst001.exe PID 3052 wrote to memory of 5068 3052 ZJNBtcQZzuwgFHceV64gW0GZ.exe inst001.exe PID 3052 wrote to memory of 5068 3052 ZJNBtcQZzuwgFHceV64gW0GZ.exe inst001.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe"C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14168 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 17044 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18384 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 18120 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16764 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 25124 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 24228 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 27720 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 27872 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 31556 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 22192 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeC:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exe3⤵
-
C:\Users\Admin\Documents\eg_zvbLuJAN4zm370uVh1QI2.exe"C:\Users\Admin\Documents\eg_zvbLuJAN4zm370uVh1QI2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exe"C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exe"C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\JGFgZLxOEyV2E26ohxEMtbxq.exe"C:\Users\Admin\Documents\JGFgZLxOEyV2E26ohxEMtbxq.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2385251.exe"C:\Users\Admin\AppData\Roaming\2385251.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6040280.exe"C:\Users\Admin\AppData\Roaming\6040280.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\8605373.exe"C:\Users\Admin\AppData\Roaming\8605373.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1608988.exe"C:\Users\Admin\AppData\Roaming\1608988.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\gPeWjY1N0dsGDonI8jn8DfZ4.exe"C:\Users\Admin\Documents\gPeWjY1N0dsGDonI8jn8DfZ4.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 6683⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 6563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 6723⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 6883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 11563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 11243⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 11403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 12603⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 12523⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe"C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 244⤵
- Executes dropped EXE
- Program crash
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8104 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeC:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exe3⤵
-
C:\Users\Admin\Documents\CGBwSwhP0CTIbdfJ0wid9VWG.exe"C:\Users\Admin\Documents\CGBwSwhP0CTIbdfJ0wid9VWG.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\J6cfVSeVTdEx4B9pPHOnOVjL.exe"C:\Users\Admin\Documents\J6cfVSeVTdEx4B9pPHOnOVjL.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 14523⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\ttSEA85SCFlhANAavfQZbLeF.exe"C:\Users\Admin\Documents\ttSEA85SCFlhANAavfQZbLeF.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\ZJNBtcQZzuwgFHceV64gW0GZ.exe"C:\Users\Admin\Documents\ZJNBtcQZzuwgFHceV64gW0GZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe"C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16028 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 17964 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 21088 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeC:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exe3⤵
-
C:\Users\Admin\Documents\vbGHm45kjCDl688_Qzqx3MlD.exe"C:\Users\Admin\Documents\vbGHm45kjCDl688_Qzqx3MlD.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\dlCXSJBy50tpXlBhY_AH26sH.exe"C:\Users\Admin\Documents\dlCXSJBy50tpXlBhY_AH26sH.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exe"C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exe"C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exe" -u3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\D8IDpZtlMsjDjKITc3nHwzpr.exe"C:\Users\Admin\Documents\D8IDpZtlMsjDjKITc3nHwzpr.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 6723⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 7203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 6403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11083⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\lKuiU0ueue9hP7fPl7qDyVfv.exe"C:\Users\Admin\Documents\lKuiU0ueue9hP7fPl7qDyVfv.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ff9ac13a380,0x7ff9ac13a390,0x7ff9ac13a3a04⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1952 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings4⤵
-
C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6f7486ee0,0x7ff6f7486ef0,0x7ff6f7486f005⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5800 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3772 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4992 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5772 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4012 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5596 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6124 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6152 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4960 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5788 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6068 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6064 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3060 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6092 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6236 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6428 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6528 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6540 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6548 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6088 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6928 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7156 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3788 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,12213876578712999899,10975807253593408811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:84⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 4616 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\lKuiU0ueue9hP7fPl7qDyVfv.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 46164⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 4616 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\lKuiU0ueue9hP7fPl7qDyVfv.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 46164⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\YvNBafQA1Kxd6pgOyi4a_mSA.exe"C:\Users\Admin\Documents\YvNBafQA1Kxd6pgOyi4a_mSA.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im YvNBafQA1Kxd6pgOyi4a_mSA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\YvNBafQA1Kxd6pgOyi4a_mSA.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im YvNBafQA1Kxd6pgOyi4a_mSA.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\GweJ4RP2BihDlJC6dU_cMShM.exe"C:\Users\Admin\Documents\GweJ4RP2BihDlJC6dU_cMShM.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\88ryMqfnztXDWPYxwm4Ni0S4.exe"C:\Users\Admin\Documents\88ryMqfnztXDWPYxwm4Ni0S4.exe"4⤵
-
C:\Users\Admin\Documents\25E49j_bOirLmq5zk9nSsb4Y.exe"C:\Users\Admin\Documents\25E49j_bOirLmq5zk9nSsb4Y.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\3620675.exe"C:\Users\Admin\AppData\Roaming\3620675.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\5043000.exe"C:\Users\Admin\AppData\Roaming\5043000.exe"5⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\5601489.exe"C:\Users\Admin\AppData\Roaming\5601489.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\5016584.exe"C:\Users\Admin\AppData\Roaming\5016584.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\5k0P7XCWBxOyZivL1lGy90jO.exe"C:\Users\Admin\Documents\5k0P7XCWBxOyZivL1lGy90jO.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-B1N6C.tmp\5k0P7XCWBxOyZivL1lGy90jO.tmp"C:\Users\Admin\AppData\Local\Temp\is-B1N6C.tmp\5k0P7XCWBxOyZivL1lGy90jO.tmp" /SL5="$10234,138429,56832,C:\Users\Admin\Documents\5k0P7XCWBxOyZivL1lGy90jO.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-D1GVE.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-D1GVE.tmp\Setup.exe" /Verysilent4⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"5⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit6⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-598N7.tmp\stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-598N7.tmp\stats.tmp" /SL5="$40272,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-93HOK.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-93HOK.tmp\Setup.exe" /Verysilent9⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\8tVRt2turMl3YkZkU27lZZSI.exe"C:\Users\Admin\Documents\8tVRt2turMl3YkZkU27lZZSI.exe"10⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST11⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\mlsdQFWWYtsGvXG2ZrmGNZ_k.exe"C:\Users\Admin\Documents\mlsdQFWWYtsGvXG2ZrmGNZ_k.exe"12⤵
-
C:\Users\Admin\Documents\_wplwTw56m7CjBljshTW2j1b.exe"C:\Users\Admin\Documents\_wplwTw56m7CjBljshTW2j1b.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\3842270.exe"C:\Users\Admin\AppData\Roaming\3842270.exe"13⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\6904694.exe"C:\Users\Admin\AppData\Roaming\6904694.exe"13⤵
-
C:\Users\Admin\AppData\Roaming\8859093.exe"C:\Users\Admin\AppData\Roaming\8859093.exe"13⤵
-
C:\Users\Admin\AppData\Roaming\1417582.exe"C:\Users\Admin\AppData\Roaming\1417582.exe"13⤵
-
C:\Users\Admin\Documents\7OaahdL3Glrn9GMAwUe1cxEu.exe"C:\Users\Admin\Documents\7OaahdL3Glrn9GMAwUe1cxEu.exe"10⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\eF8NoBbDJIA_nv7YKD0YRF6o.exe"C:\Users\Admin\Documents\eF8NoBbDJIA_nv7YKD0YRF6o.exe"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\eF8NoBbDJIA_nv7YKD0YRF6o.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\eF8NoBbDJIA_nv7YKD0YRF6o.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\eF8NoBbDJIA_nv7YKD0YRF6o.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\eF8NoBbDJIA_nv7YKD0YRF6o.exe" ) do taskkill /f -im "%~nxA"12⤵
-
C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXEX4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"15⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -im "eF8NoBbDJIA_nv7YKD0YRF6o.exe"13⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\RHqaDmPUeBry00utiXoaQskq.exe"C:\Users\Admin\Documents\RHqaDmPUeBry00utiXoaQskq.exe"10⤵
-
C:\Users\Admin\Documents\FHjDMKWxZ3fD1y36Gdk09a2j.exe"C:\Users\Admin\Documents\FHjDMKWxZ3fD1y36Gdk09a2j.exe"10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 65611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 67211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 68011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 72811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 112011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 115211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 116011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 120011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 126011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 124011⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\wgI8nnLLoARa0hpW0v13g39m.exe"C:\Users\Admin\Documents\wgI8nnLLoARa0hpW0v13g39m.exe"10⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im wgI8nnLLoARa0hpW0v13g39m.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\wgI8nnLLoARa0hpW0v13g39m.exe" & del C:\ProgramData\*.dll & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im wgI8nnLLoARa0hpW0v13g39m.exe /f12⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\EMBE79WkMdkxF2V2eJOCkXsQ.exe"C:\Users\Admin\Documents\EMBE79WkMdkxF2V2eJOCkXsQ.exe"10⤵
-
C:\Users\Admin\Documents\EMBE79WkMdkxF2V2eJOCkXsQ.exe"C:\Users\Admin\Documents\EMBE79WkMdkxF2V2eJOCkXsQ.exe"11⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\UwxwvynVoEScH3wY_Wttn1_7.exe"C:\Users\Admin\Documents\UwxwvynVoEScH3wY_Wttn1_7.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 9652 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UwxwvynVoEScH3wY_Wttn1_7.exe"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 965212⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 9652 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UwxwvynVoEScH3wY_Wttn1_7.exe"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 965212⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe"C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe"10⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9708 -s 2412⤵
- Program crash
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 27532 -s 2412⤵
- Program crash
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 31288 -s 2412⤵
- Program crash
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exeC:\Users\Admin\Documents\PvRrvi06R4pVostcilHJONbS.exe11⤵
-
C:\Users\Admin\Documents\dP8Sx3f9dCINjk0Tk4TXno3d.exe"C:\Users\Admin\Documents\dP8Sx3f9dCINjk0Tk4TXno3d.exe"10⤵
-
C:\Users\Admin\Documents\GNZ9JCTz_qnFkioP5yBVCjGz.exe"C:\Users\Admin\Documents\GNZ9JCTz_qnFkioP5yBVCjGz.exe"10⤵
-
C:\Users\Admin\Documents\AXvDpWR_JeejGchs5XR_G9G_.exe"C:\Users\Admin\Documents\AXvDpWR_JeejGchs5XR_G9G_.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\5707257.exe"C:\Users\Admin\AppData\Roaming\5707257.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\4852999.exe"C:\Users\Admin\AppData\Roaming\4852999.exe"11⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\4635225.exe"C:\Users\Admin\AppData\Roaming\4635225.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\8361617.exe"C:\Users\Admin\AppData\Roaming\8361617.exe"11⤵
-
C:\Users\Admin\Documents\GvRYKdvHwheIvjETTHK5bA3u.exe"C:\Users\Admin\Documents\GvRYKdvHwheIvjETTHK5bA3u.exe"10⤵
-
C:\Users\Admin\Documents\mQKRN2UqSKdXtV8eg3n8Fh4t.exe"C:\Users\Admin\Documents\mQKRN2UqSKdXtV8eg3n8Fh4t.exe"10⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe"C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe"10⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16340 -s 2412⤵
- Program crash
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exeC:\Users\Admin\Documents\n4gBqi632Yk0rFFLMZZeHMiT.exe11⤵
-
C:\Users\Admin\Documents\2I3RZqrfj1fuo6K5Ezlyc9Us.exe"C:\Users\Admin\Documents\2I3RZqrfj1fuo6K5Ezlyc9Us.exe"10⤵
-
C:\Users\Admin\Documents\0EiJHw_6J95CummzvnUwhjaq.exe"C:\Users\Admin\Documents\0EiJHw_6J95CummzvnUwhjaq.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\3055216.exe"C:\Users\Admin\AppData\Roaming\3055216.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\1145138.exe"C:\Users\Admin\AppData\Roaming\1145138.exe"11⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\3379095.exe"C:\Users\Admin\AppData\Roaming\3379095.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\1670580.exe"C:\Users\Admin\AppData\Roaming\1670580.exe"11⤵
-
C:\Users\Admin\Documents\RANAHrYfewyREYwy7HURW9L3.exe"C:\Users\Admin\Documents\RANAHrYfewyREYwy7HURW9L3.exe"10⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\LKm7nSXNp9aZHerYN_FxqEL8.exe"C:\Users\Admin\Documents\LKm7nSXNp9aZHerYN_FxqEL8.exe"10⤵
-
C:\Users\Admin\Documents\LKm7nSXNp9aZHerYN_FxqEL8.exe"C:\Users\Admin\Documents\LKm7nSXNp9aZHerYN_FxqEL8.exe" -u11⤵
-
C:\Users\Admin\Documents\u6amjGimhBlN8BglJw9gutH_.exe"C:\Users\Admin\Documents\u6amjGimhBlN8BglJw9gutH_.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-P3UGU.tmp\u6amjGimhBlN8BglJw9gutH_.tmp"C:\Users\Admin\AppData\Local\Temp\is-P3UGU.tmp\u6amjGimhBlN8BglJw9gutH_.tmp" /SL5="$30570,138429,56832,C:\Users\Admin\Documents\u6amjGimhBlN8BglJw9gutH_.exe"11⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-78Q57.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-78Q57.tmp\Setup.exe" /Verysilent12⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"7⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"7⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a8⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\8664981.exe"C:\Users\Admin\AppData\Roaming\8664981.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\4791552.exe"C:\Users\Admin\AppData\Roaming\4791552.exe"8⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\2951143.exe"C:\Users\Admin\AppData\Roaming\2951143.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\8054287.exe"C:\Users\Admin\AppData\Roaming\8054287.exe"8⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"7⤵
-
C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe"C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe" /Verysilent7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost32.exeC:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"7⤵
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'9⤵
- Creates scheduled task(s)
-
C:\Windows\system32\services32.exe"C:\Windows\system32\services32.exe"8⤵
-
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions2⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\is-OMKK2.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-OMKK2.tmp\VPN.tmp" /SL5="$4021E,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\VPN.exe" /Verysilent1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-G4SA9.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-G4SA9.tmp\Setup.exe" /silent /subid=7202⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DTK02.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DTK02.tmp\Setup.tmp" /SL5="$801D8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-G4SA9.tmp\Setup.exe" /silent /subid=7203⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "4⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09015⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "4⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09015⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall4⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\RepairSet.ps1"1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\DisconnectShow.xhtml1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:11620 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{48294ad4-fd94-134e-a3fd-16757c817a7d}\oemvista.inf" "9" "4d14a44ff" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000178"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\9DB6.exeC:\Users\Admin\AppData\Local\Temp\9DB6.exe1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\A4AC.exeC:\Users\Admin\AppData\Local\Temp\A4AC.exe1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\F6F3.exeC:\Users\Admin\AppData\Local\Temp\F6F3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F30.exeC:\Users\Admin\AppData\Local\Temp\F30.exe1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\78C8.exeC:\Users\Admin\AppData\Local\Temp\78C8.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\B2F3.exeC:\Users\Admin\AppData\Local\Temp\B2F3.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start2⤵
- Enumerates connected drives
-
C:\Users\Admin\AppData\Local\Temp\F0C9.exeC:\Users\Admin\AppData\Local\Temp\F0C9.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Change Default File Association
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
Modify Registry
5Disabling Security Tools
1File Deletion
2Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\inst001.exeMD5
23bcdc132d1f2aaf8d248b6a5bd21801
SHA12153acec77f4a57c621a3e38d523eb6df9b29134
SHA256a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b
SHA512d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db
-
C:\Program Files (x86)\Company\NewProduct\inst001.exeMD5
23bcdc132d1f2aaf8d248b6a5bd21801
SHA12153acec77f4a57c621a3e38d523eb6df9b29134
SHA256a7cb6d861c75f36c32cb5a304b0d8d84b5bc0bedd7da2eb942e4d67288f7123b
SHA512d9684eab46e5431bc69b70154bbef7a3126f0719a80792f120a3a436e6f4f23cf1229d4b4293c1aff4202ab748144ce19dbc4c39f74f631e1b6f9336259f02db
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exeMD5
68737ab1a037878a37f0b3e114edaaf8
SHA10ba735d99c77cb69937f8fcf89c6a9e3bc495512
SHA2567bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a
SHA512f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exeMD5
68737ab1a037878a37f0b3e114edaaf8
SHA10ba735d99c77cb69937f8fcf89c6a9e3bc495512
SHA2567bf16a22ac10e1dc50dc302c7d1c196dff361ee5c8e830ddb0cec90b548b483a
SHA512f30fa001c604fe4aee324fc4af5b784feae262a62983bd2364721f83ad2522b714c0286b97569b927da5741339d8a0633cbd6abcae3e45f943d5f4ae9168b271
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exeMD5
c6d71be1016cf51f7b2d04e2eefbb6e7
SHA1b31d9318e78ec4355412dd1cb70c1bddec004458
SHA256df635c8722e0eb4b85af00b4ee365f005adc11bf999e604141d5f0c36bcf739b
SHA5129d8000b5b4241192cf4d86c66d4186ccb2a49f5e25efd793268b8fb5c2065c4c1c42a6fbf98594563ab09948cbed4abf28ee0de67b9443285c0bde539880593d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.DLLMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\MSVCP140.dllMD5
d4c601e8c1c38954c29855b7016183ac
SHA1dec6d8546d7487c9af671e287415b54e8fff0940
SHA256d59c4953fca6a2bc1957273a18fc94d8b28fd083b84021b7268dff6fc3781fcf
SHA512febd0bd6e412d7276812ed895d51c54b39cca3d646c076e5786cdf935c0ced3d20244a5411013474276d3abc43bc79e1e9e6f8c144651d8f7f75af8f4784c12b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\Telemetry.dllMD5
b4770ab4d34d3c1653d57c44683dfda5
SHA1b5e33187125891427d36cc7c6319d7584793330c
SHA2561e08e3b3f13a3b70d959879fae71091302fbefb1d15ecd5c44e5a858809eafec
SHA5129e5c6a5d4cc6d706e5c2858e5500ed4c1a5f2472c76b03f4845b6951cbe1512aae7431daa225c134d66c77374d74d71f48d6c417f465abfefbe1e364f4b24c16
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\UpdateRingSettings.dllMD5
6eedf5b0ec34ab63ccfba8f9cb3d79bb
SHA1c1b72dcfd33627182b8dea84eb03b21fd78ffb82
SHA256a4f1318343ebfacb0bcc91ef9f5431effb529e276eee29efdff549374dff229a
SHA512ade0a3096324d4de1accf14af584e97247495bc467a92dfc48ef9eeae9a0dbebe63089a97c6f6c4f023451a5bd042eb3fd90ed19673f847aa082b71ba4be318e
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\VCRUNTIME140.dllMD5
da4f88df70cfc535782c334bb145bb5e
SHA195fad296dcf470799fa5f1bf7bf401760da757d1
SHA256bf86ad2fdd2c39ac64776643d74a9257df13b5fb1e1c89ccb793847ba927e6d2
SHA512a626c0c247a0b993487292ca17349ed9a5b32f6d2ecd1f24140c0f86592a81ba32ba6e929ba2a0bd24ea7285e058e1da03df34448140e7ada88824bccfbe5764
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\is-B1N6C.tmp\5k0P7XCWBxOyZivL1lGy90jO.tmpMD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
C:\Users\Admin\Documents\5k0P7XCWBxOyZivL1lGy90jO.exeMD5
4c91ebf5b18e08cf75fe9d7b567d4093
SHA1f76f07af066f31f39e7723ee0a841a752767c23c
SHA25626658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721
SHA512cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3
-
C:\Users\Admin\Documents\5k0P7XCWBxOyZivL1lGy90jO.exeMD5
4c91ebf5b18e08cf75fe9d7b567d4093
SHA1f76f07af066f31f39e7723ee0a841a752767c23c
SHA25626658599bfea61f5a5db01ce91144702653e9ecf92eda1f54479ce1f48876721
SHA512cd95b1fed25558e1eaae71aeec797130a2f840403959dd2ca07378bbe3b2773a9e5c22f5be58c0959b29e8c9df9ff78e87abc587bd93d07dfb5f435217ec87f3
-
C:\Users\Admin\Documents\CGBwSwhP0CTIbdfJ0wid9VWG.exeMD5
67fbe5fba28b9c572da7f81cde3cc91d
SHA1e126248c56928e4b3bc2e72137e2341ecaec2053
SHA256a287c80ac4fcb1fdacc83099123083fb1869f2e58170ce39acbbcd062164906d
SHA5124be521e569e0635afd593ca780e0ababb51fad2eff045d9b75b710c1521130f17b93ef169a59577b4eff923f3f097ed4d2785a2fdbca2fb2ed0b20717db0e259
-
C:\Users\Admin\Documents\CGBwSwhP0CTIbdfJ0wid9VWG.exeMD5
67fbe5fba28b9c572da7f81cde3cc91d
SHA1e126248c56928e4b3bc2e72137e2341ecaec2053
SHA256a287c80ac4fcb1fdacc83099123083fb1869f2e58170ce39acbbcd062164906d
SHA5124be521e569e0635afd593ca780e0ababb51fad2eff045d9b75b710c1521130f17b93ef169a59577b4eff923f3f097ed4d2785a2fdbca2fb2ed0b20717db0e259
-
C:\Users\Admin\Documents\D8IDpZtlMsjDjKITc3nHwzpr.exeMD5
d5b734e2cc764deb7565fbdfa7b88a20
SHA17ef84d80dd1a8903ffcd389406aa6feec858cebf
SHA25687a0263afea667048ae4a1af557091d82ce9ff7fadace73335ddfe772c705e2f
SHA512b9adbade7b3a0760ae07f6b4eca52f5305552a9c3519a74faae97a3af01b63656ec91e54aec3eb90ac8ca575fc3983a05331f52010c6db6d10fd820d4abb1ff7
-
C:\Users\Admin\Documents\D8IDpZtlMsjDjKITc3nHwzpr.exeMD5
d5b734e2cc764deb7565fbdfa7b88a20
SHA17ef84d80dd1a8903ffcd389406aa6feec858cebf
SHA25687a0263afea667048ae4a1af557091d82ce9ff7fadace73335ddfe772c705e2f
SHA512b9adbade7b3a0760ae07f6b4eca52f5305552a9c3519a74faae97a3af01b63656ec91e54aec3eb90ac8ca575fc3983a05331f52010c6db6d10fd820d4abb1ff7
-
C:\Users\Admin\Documents\GweJ4RP2BihDlJC6dU_cMShM.exeMD5
abeea23c95c98bc3cbc6d9d4508a0a2f
SHA1b9b202c2e2da2073b4e332a7401159118581d10c
SHA256df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d
SHA5126fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f
-
C:\Users\Admin\Documents\GweJ4RP2BihDlJC6dU_cMShM.exeMD5
abeea23c95c98bc3cbc6d9d4508a0a2f
SHA1b9b202c2e2da2073b4e332a7401159118581d10c
SHA256df7734cbb1baf26783f02249ac1b725286ae3709233cb3e78955cb6873597e6d
SHA5126fb725f1e067382a2ff6e153f9a3f02fb9d277248cf1b06c0541feef3919d8813f18f54b25899d9d7f6e0651fcfeec7d98fee9300c404c8e04c0606712261d9f
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeMD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
C:\Users\Admin\Documents\HOsbP4Z18so2RCYTJmdWOsmg.exeMD5
e20eadf0f3063e0a73ca8569cd7c3c1b
SHA1995b8fecebb1ff10f9f6571c73d1ea49d5722477
SHA25681f327dfcb337af8d576630d797059c5501a84cecb3612b69a2085cb2a74b494
SHA512d226b5f133ecff0eb41a21c6a8feeeae5da1931f4326f5fb893f11eb3faff1fc460d188149f968fcf4437abf3b0fe8c49b01d463f8e8d0e54e9ae149027786ef
-
C:\Users\Admin\Documents\J6cfVSeVTdEx4B9pPHOnOVjL.exeMD5
cf6f22bc7f95e56ffd773384bcea3255
SHA1b81921cbf02f968ec437b423ef5fe11b8becc3c0
SHA25605bcca251522d1eef374463b048fd81ff6460d178966c211cf1cb311b945ef47
SHA5126bb77ef001a74ef58a37699fce556ebcf2ae839f79866e8d47faca03d62e8342d39775490aeff895194dcd35884ad594a319e2eb61fead0eab1e97c0e9e322bf
-
C:\Users\Admin\Documents\JGFgZLxOEyV2E26ohxEMtbxq.exeMD5
82847b456708d7b247a771b31ce45c29
SHA1cd2ffdf128c4856ec81e17414bb5a44cdf592f64
SHA2565804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a
SHA512c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4
-
C:\Users\Admin\Documents\JGFgZLxOEyV2E26ohxEMtbxq.exeMD5
82847b456708d7b247a771b31ce45c29
SHA1cd2ffdf128c4856ec81e17414bb5a44cdf592f64
SHA2565804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a
SHA512c2318dc1a2caa256296c0f73690bb00de46bff9ee38f7a3e8f54d37e62e0cae33981217301d5188b4b6403e538fd30d5a61b6c242f58d89a05f7a59225be11f4
-
C:\Users\Admin\Documents\YvNBafQA1Kxd6pgOyi4a_mSA.exeMD5
78c06b9a03f2d8fcb86e7e0a8cedb5da
SHA12f44713c28754eeef871ccbbd9e8784dd145d5f8
SHA256aa12ad772adf47f16f71cd07714ee02ed1fddab1fa80551d6dbc5d50589aebfc
SHA5127e9447aa24927deeb094c0211b1cd0302bf3479e53ac225e8c4fb9bc68905ae645b3ce3e11cad2b9c54a5811f2615235bff2ce00d1b0b328ae532fda9720c771
-
C:\Users\Admin\Documents\YvNBafQA1Kxd6pgOyi4a_mSA.exeMD5
78c06b9a03f2d8fcb86e7e0a8cedb5da
SHA12f44713c28754eeef871ccbbd9e8784dd145d5f8
SHA256aa12ad772adf47f16f71cd07714ee02ed1fddab1fa80551d6dbc5d50589aebfc
SHA5127e9447aa24927deeb094c0211b1cd0302bf3479e53ac225e8c4fb9bc68905ae645b3ce3e11cad2b9c54a5811f2615235bff2ce00d1b0b328ae532fda9720c771
-
C:\Users\Admin\Documents\ZJNBtcQZzuwgFHceV64gW0GZ.exeMD5
e0ef2cfe575206c8a60ddba16c3be2f5
SHA12f86c600a2d7be4e36a7e23e94283fc38dd5b166
SHA256dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7
SHA512d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d
-
C:\Users\Admin\Documents\ZJNBtcQZzuwgFHceV64gW0GZ.exeMD5
e0ef2cfe575206c8a60ddba16c3be2f5
SHA12f86c600a2d7be4e36a7e23e94283fc38dd5b166
SHA256dd38ee7be4658da5bd9cec0830fe7528d8d31ac62922519e5a503a6ec1ea84a7
SHA512d2f0bd0878d1f9dc34d314b2dff919eae98166d3cb161154648e77f05ae9edb2c71b3fc1700fde12d377de38dacc2598d0ccc6d990160a75c5b9fee734ed068d
-
C:\Users\Admin\Documents\dlCXSJBy50tpXlBhY_AH26sH.exeMD5
f19ea8b8132065599887c7fb760d48ee
SHA124d6d6a384a43c5a81b25ed2c2ddc80bba708c3b
SHA25659b6e6fbe133319e646e4c88d3d9bc4ad0259dc96d4d2cd97b227bb9b7da6bdb
SHA5122c6f52b6299583fb3f4cc4a5293ad80dba901dd06b6b2a4e13bde8589b4465741287f5fb73fc6a2c8d524bb68cc4f86a32118a3cc5acb295ac7c29afe8a0c5ca
-
C:\Users\Admin\Documents\dlCXSJBy50tpXlBhY_AH26sH.exeMD5
f19ea8b8132065599887c7fb760d48ee
SHA124d6d6a384a43c5a81b25ed2c2ddc80bba708c3b
SHA25659b6e6fbe133319e646e4c88d3d9bc4ad0259dc96d4d2cd97b227bb9b7da6bdb
SHA5122c6f52b6299583fb3f4cc4a5293ad80dba901dd06b6b2a4e13bde8589b4465741287f5fb73fc6a2c8d524bb68cc4f86a32118a3cc5acb295ac7c29afe8a0c5ca
-
C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exeMD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exeMD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
C:\Users\Admin\Documents\eadgalboaW0LQtFB44FNjP7k.exeMD5
7411bd9a32735dfdeee38ee1f6629a7f
SHA15ebcd716a0a2c34bb57f3323fcc8ff081a9a78d0
SHA25618af72f75d6dbdffa8f8319d5d76f9b1a8cb51e99e1b937948bdcc7af6665511
SHA512806a75265ffb302311eab389ea563382f51ef525b8095a9fd10fdfb2da4f295f414b59e2bb14c25130bead481364f75fe966f38bc4f05818a9c82806725749eb
-
C:\Users\Admin\Documents\eg_zvbLuJAN4zm370uVh1QI2.exeMD5
7078d048869d7d3d226c9d3ed6ed74e2
SHA18806b62c5eaf75fd5f112ae120afeb84f04d8460
SHA2567ac3c1e1ba3ea2779c5c98781f573c3fe87c63342860cb8f923d3ac5af601f5b
SHA512ba580a488fca110e5d6a82df76e11347befb0ad2b248c7a5bc73e26f82d7a0a0e10c6bff063f1635a4e60788c5ec48643bf7549d1e9ce0e021ec517e3961f7fb
-
C:\Users\Admin\Documents\eg_zvbLuJAN4zm370uVh1QI2.exeMD5
7078d048869d7d3d226c9d3ed6ed74e2
SHA18806b62c5eaf75fd5f112ae120afeb84f04d8460
SHA2567ac3c1e1ba3ea2779c5c98781f573c3fe87c63342860cb8f923d3ac5af601f5b
SHA512ba580a488fca110e5d6a82df76e11347befb0ad2b248c7a5bc73e26f82d7a0a0e10c6bff063f1635a4e60788c5ec48643bf7549d1e9ce0e021ec517e3961f7fb
-
C:\Users\Admin\Documents\gPeWjY1N0dsGDonI8jn8DfZ4.exeMD5
fdf3ed555936a81fe9476932a2e56fc1
SHA1882090bc03f78af7d3ded6da08530add57ae7479
SHA256643f392c9e265c8e805c1a420f5ef1f24687fd57a6d89965895bdc475957e09b
SHA512f21bace406e8d326d5572ebec1026679acf41dbeb102770d963f3b4b8301f79e81c6187c42527a8d3a5344fae1c8b9f22cdc94058336fb2598a20f1f32527bca
-
C:\Users\Admin\Documents\gPeWjY1N0dsGDonI8jn8DfZ4.exeMD5
fdf3ed555936a81fe9476932a2e56fc1
SHA1882090bc03f78af7d3ded6da08530add57ae7479
SHA256643f392c9e265c8e805c1a420f5ef1f24687fd57a6d89965895bdc475957e09b
SHA512f21bace406e8d326d5572ebec1026679acf41dbeb102770d963f3b4b8301f79e81c6187c42527a8d3a5344fae1c8b9f22cdc94058336fb2598a20f1f32527bca
-
C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exeMD5
b807066314d8a5b96f3cc0f5f70bbd60
SHA12d7f81acefc759765600c8cf8a139729abb1b2e0
SHA2562dcc9bc5615905efa08f65de422e8b4de78e9b62f982d0f31ff5100a00ddb495
SHA5121f7fe355730d81535e1cded5e9a09fbe819c802dc0b772150280bcafb4986b3bba86ff4a7897840aa4c16a4898d1c76b5c2b157401cb784afa57e42cc6cb6ec8
-
C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exeMD5
b807066314d8a5b96f3cc0f5f70bbd60
SHA12d7f81acefc759765600c8cf8a139729abb1b2e0
SHA2562dcc9bc5615905efa08f65de422e8b4de78e9b62f982d0f31ff5100a00ddb495
SHA5121f7fe355730d81535e1cded5e9a09fbe819c802dc0b772150280bcafb4986b3bba86ff4a7897840aa4c16a4898d1c76b5c2b157401cb784afa57e42cc6cb6ec8
-
C:\Users\Admin\Documents\kRexbEtzPQ3A2qnNCXpxEva7.exeMD5
b807066314d8a5b96f3cc0f5f70bbd60
SHA12d7f81acefc759765600c8cf8a139729abb1b2e0
SHA2562dcc9bc5615905efa08f65de422e8b4de78e9b62f982d0f31ff5100a00ddb495
SHA5121f7fe355730d81535e1cded5e9a09fbe819c802dc0b772150280bcafb4986b3bba86ff4a7897840aa4c16a4898d1c76b5c2b157401cb784afa57e42cc6cb6ec8
-
C:\Users\Admin\Documents\lKuiU0ueue9hP7fPl7qDyVfv.exeMD5
30b21677cf7a267da2ef6daff813d054
SHA196e85b3a93eee8411bedec902cc30c7f378966c6
SHA25698b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172
SHA5120fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f
-
C:\Users\Admin\Documents\lKuiU0ueue9hP7fPl7qDyVfv.exeMD5
30b21677cf7a267da2ef6daff813d054
SHA196e85b3a93eee8411bedec902cc30c7f378966c6
SHA25698b5264d43dd36905b4383d8851a97d54fd985713885f6a17edf0b10b6737172
SHA5120fbf3300f49bae958888629e96aad695a8b914644d295341e4ef8d3728b7cc77ed9f36d789fa09ba93b08d78c71dd8e4c26aa87204680516f0a9477936dc2c7f
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeMD5
cce7d1df09ce4d4051217bbff4740abb
SHA12cec59fa48116d7a474d35a343b27c8f757c445a
SHA25673fb4f3ccb12db716b72f5b18dd9fca14ae7b0c23c8bd72aaa156b0f3870a1b1
SHA5127a70ce00e78e5203e0adf2c5f3e7f2cf811da9ae23be4836d9e2832c462598b9b78f21bc5360cc50017b120335a8ac2ac4e6b3e221afa47c31b9765f459719ab
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeMD5
cce7d1df09ce4d4051217bbff4740abb
SHA12cec59fa48116d7a474d35a343b27c8f757c445a
SHA25673fb4f3ccb12db716b72f5b18dd9fca14ae7b0c23c8bd72aaa156b0f3870a1b1
SHA5127a70ce00e78e5203e0adf2c5f3e7f2cf811da9ae23be4836d9e2832c462598b9b78f21bc5360cc50017b120335a8ac2ac4e6b3e221afa47c31b9765f459719ab
-
C:\Users\Admin\Documents\sIPgivvw6w2EUcxZtACYvmll.exeMD5
cce7d1df09ce4d4051217bbff4740abb
SHA12cec59fa48116d7a474d35a343b27c8f757c445a
SHA25673fb4f3ccb12db716b72f5b18dd9fca14ae7b0c23c8bd72aaa156b0f3870a1b1
SHA5127a70ce00e78e5203e0adf2c5f3e7f2cf811da9ae23be4836d9e2832c462598b9b78f21bc5360cc50017b120335a8ac2ac4e6b3e221afa47c31b9765f459719ab
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeMD5
ee558358e0210fac68e8e64d32adca4e
SHA17e1cc4531f6ff07476c2f1eddc3d5ab02e9e5590
SHA256e31887ee65c8d2262c10925f2dc3a95da667d913e32eafa7011649a625840182
SHA512ddeec6c5fafa209da9ac0ce538b10e86585dea1246f4e7cb837021627d5846bb4a802215b2e21c285a253d857dbfe2dbe6ba581d08a7f59f4352394f58cd7379
-
C:\Users\Admin\Documents\szhhHmrxnbLce7zuA3EXFdwa.exeMD5
ee558358e0210fac68e8e64d32adca4e
SHA17e1cc4531f6ff07476c2f1eddc3d5ab02e9e5590
SHA256e31887ee65c8d2262c10925f2dc3a95da667d913e32eafa7011649a625840182
SHA512ddeec6c5fafa209da9ac0ce538b10e86585dea1246f4e7cb837021627d5846bb4a802215b2e21c285a253d857dbfe2dbe6ba581d08a7f59f4352394f58cd7379
-
C:\Users\Admin\Documents\ttSEA85SCFlhANAavfQZbLeF.exeMD5
1c65db9246f7f32a763e640c916bd695
SHA101d81fcaf6db30f8d39ad771e30df32e556dc304
SHA256d0f70057bea8d21fc9bb9d20770852896d18920ffc61957bfb0d52c9b8ae367d
SHA5125333e633d6cc54f3f1fd7ad04831c629e1568f9241da12ac8a770238e2f8fc4cf350f50f7c6e937f5d1d2d7ff68460455f043f854713f7e322e24365fdf7c718
-
C:\Users\Admin\Documents\ttSEA85SCFlhANAavfQZbLeF.exeMD5
1c65db9246f7f32a763e640c916bd695
SHA101d81fcaf6db30f8d39ad771e30df32e556dc304
SHA256d0f70057bea8d21fc9bb9d20770852896d18920ffc61957bfb0d52c9b8ae367d
SHA5125333e633d6cc54f3f1fd7ad04831c629e1568f9241da12ac8a770238e2f8fc4cf350f50f7c6e937f5d1d2d7ff68460455f043f854713f7e322e24365fdf7c718
-
C:\Users\Admin\Documents\vbGHm45kjCDl688_Qzqx3MlD.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Users\Admin\Documents\vbGHm45kjCDl688_Qzqx3MlD.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.dllMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.dllMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\LoggingPlatform.dllMD5
7939f580b99f4ab153fc4ea6791e12c5
SHA13e1446c7f09f7131df177eb81e74787de2278e46
SHA25643d64945b036f774f93ae6cce67bb82fe8062147d98821d173d4861e2f83e18c
SHA512090e57bc7cf321d52b40bc4748e2f4ea1170dae3df96645e003ce2900efbcb840931d572cba163f20b51b83fbd722e95b7ae747ec6dc9c6aa1b55a3cbbd5a215
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\Telemetry.dllMD5
b4770ab4d34d3c1653d57c44683dfda5
SHA1b5e33187125891427d36cc7c6319d7584793330c
SHA2561e08e3b3f13a3b70d959879fae71091302fbefb1d15ecd5c44e5a858809eafec
SHA5129e5c6a5d4cc6d706e5c2858e5500ed4c1a5f2472c76b03f4845b6951cbe1512aae7431daa225c134d66c77374d74d71f48d6c417f465abfefbe1e364f4b24c16
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\UpdateRingSettings.dllMD5
6eedf5b0ec34ab63ccfba8f9cb3d79bb
SHA1c1b72dcfd33627182b8dea84eb03b21fd78ffb82
SHA256a4f1318343ebfacb0bcc91ef9f5431effb529e276eee29efdff549374dff229a
SHA512ade0a3096324d4de1accf14af584e97247495bc467a92dfc48ef9eeae9a0dbebe63089a97c6f6c4f023451a5bd042eb3fd90ed19673f847aa082b71ba4be318e
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\msvcp140.dllMD5
d4c601e8c1c38954c29855b7016183ac
SHA1dec6d8546d7487c9af671e287415b54e8fff0940
SHA256d59c4953fca6a2bc1957273a18fc94d8b28fd083b84021b7268dff6fc3781fcf
SHA512febd0bd6e412d7276812ed895d51c54b39cca3d646c076e5786cdf935c0ced3d20244a5411013474276d3abc43bc79e1e9e6f8c144651d8f7f75af8f4784c12b
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\vcruntime140.dllMD5
da4f88df70cfc535782c334bb145bb5e
SHA195fad296dcf470799fa5f1bf7bf401760da757d1
SHA256bf86ad2fdd2c39ac64776643d74a9257df13b5fb1e1c89ccb793847ba927e6d2
SHA512a626c0c247a0b993487292ca17349ed9a5b32f6d2ecd1f24140c0f86592a81ba32ba6e929ba2a0bd24ea7285e058e1da03df34448140e7ada88824bccfbe5764
-
\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\vcruntime140.dllMD5
da4f88df70cfc535782c334bb145bb5e
SHA195fad296dcf470799fa5f1bf7bf401760da757d1
SHA256bf86ad2fdd2c39ac64776643d74a9257df13b5fb1e1c89ccb793847ba927e6d2
SHA512a626c0c247a0b993487292ca17349ed9a5b32f6d2ecd1f24140c0f86592a81ba32ba6e929ba2a0bd24ea7285e058e1da03df34448140e7ada88824bccfbe5764
-
\Users\Admin\AppData\Local\Temp\is-D1GVE.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
\Users\Admin\AppData\Local\Temp\is-D1GVE.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
memory/8-381-0x000000000041C5C2-mapping.dmp
-
memory/8-422-0x0000000005430000-0x0000000005A36000-memory.dmpFilesize
6.0MB
-
memory/1040-336-0x0000000000000000-mapping.dmp
-
memory/1464-261-0x000000000041C5C2-mapping.dmp
-
memory/1464-290-0x0000000005570000-0x0000000005B76000-memory.dmpFilesize
6.0MB
-
memory/1464-260-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2108-309-0x0000000003180000-0x0000000003196000-memory.dmpFilesize
88KB
-
memory/2124-356-0x0000000000000000-mapping.dmp
-
memory/2124-412-0x0000000000CC0000-0x0000000000CC2000-memory.dmpFilesize
8KB
-
memory/2732-459-0x0000000000000000-mapping.dmp
-
memory/2944-209-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/2944-187-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/2944-136-0x0000000000000000-mapping.dmp
-
memory/2948-247-0x0000000002B50000-0x0000000002C9A000-memory.dmpFilesize
1.3MB
-
memory/2948-134-0x0000000000000000-mapping.dmp
-
memory/2996-327-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB
-
memory/2996-315-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2996-236-0x0000000003070000-0x00000000030AC000-memory.dmpFilesize
240KB
-
memory/2996-263-0x00000000047A0000-0x00000000047A1000-memory.dmpFilesize
4KB
-
memory/2996-256-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/2996-240-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/2996-320-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/2996-216-0x0000000000000000-mapping.dmp
-
memory/2996-238-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2996-323-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/2996-267-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/2996-246-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/2996-325-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/2996-314-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/2996-316-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/2996-319-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/2996-328-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/2996-332-0x0000000004860000-0x0000000004861000-memory.dmpFilesize
4KB
-
memory/2996-330-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/2996-243-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/2996-254-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/3052-150-0x0000000000000000-mapping.dmp
-
memory/3112-318-0x000000000041C5C2-mapping.dmp
-
memory/3200-173-0x0000000000000000-mapping.dmp
-
memory/3200-292-0x0000000000400000-0x0000000002BB0000-memory.dmpFilesize
39.7MB
-
memory/3200-249-0x0000000004880000-0x0000000004953000-memory.dmpFilesize
844KB
-
memory/3764-339-0x000000000041C5BA-mapping.dmp
-
memory/3764-357-0x0000000005480000-0x0000000005A86000-memory.dmpFilesize
6.0MB
-
memory/3828-540-0x00007FF6745E4060-mapping.dmp
-
memory/3904-132-0x0000000003790000-0x00000000038CF000-memory.dmpFilesize
1.2MB
-
memory/3932-219-0x0000000000000000-mapping.dmp
-
memory/3932-228-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/4048-148-0x0000000000000000-mapping.dmp
-
memory/4116-360-0x0000000000000000-mapping.dmp
-
memory/4192-214-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/4192-191-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/4192-149-0x0000000000000000-mapping.dmp
-
memory/4200-268-0x000000000041C5BE-mapping.dmp
-
memory/4200-264-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/4200-296-0x00000000053A0000-0x00000000059A6000-memory.dmpFilesize
6.0MB
-
memory/4268-164-0x0000000000000000-mapping.dmp
-
memory/4300-245-0x0000000002C50000-0x0000000002D9A000-memory.dmpFilesize
1.3MB
-
memory/4300-258-0x0000000000400000-0x0000000002B50000-memory.dmpFilesize
39.3MB
-
memory/4300-165-0x0000000000000000-mapping.dmp
-
memory/4312-140-0x0000000000000000-mapping.dmp
-
memory/4312-181-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/4312-203-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/4312-230-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/4312-195-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/4312-278-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4336-137-0x0000000000000000-mapping.dmp
-
memory/4336-466-0x0000000077AE0000-0x0000000077C6E000-memory.dmpFilesize
1.6MB
-
memory/4348-211-0x0000000000000000-mapping.dmp
-
memory/4376-212-0x000000001B640000-0x000000001B641000-memory.dmpFilesize
4KB
-
memory/4376-224-0x0000000002520000-0x0000000002522000-memory.dmpFilesize
8KB
-
memory/4376-133-0x0000000000000000-mapping.dmp
-
memory/4376-196-0x0000000000E90000-0x0000000000EA8000-memory.dmpFilesize
96KB
-
memory/4376-167-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/4384-135-0x0000000000000000-mapping.dmp
-
memory/4384-408-0x0000000000400000-0x0000000002F73000-memory.dmpFilesize
43.4MB
-
memory/4384-382-0x0000000003850000-0x0000000004177000-memory.dmpFilesize
9.2MB
-
memory/4428-115-0x0000000000000000-mapping.dmp
-
memory/4456-162-0x0000000000000000-mapping.dmp
-
memory/4456-298-0x0000000004B32000-0x0000000004B33000-memory.dmpFilesize
4KB
-
memory/4456-297-0x0000000004B10000-0x0000000004B2E000-memory.dmpFilesize
120KB
-
memory/4456-253-0x0000000002B60000-0x0000000002CAA000-memory.dmpFilesize
1.3MB
-
memory/4456-302-0x0000000004B33000-0x0000000004B34000-memory.dmpFilesize
4KB
-
memory/4456-304-0x0000000000400000-0x0000000002B59000-memory.dmpFilesize
39.3MB
-
memory/4456-291-0x0000000002DC0000-0x0000000002DDF000-memory.dmpFilesize
124KB
-
memory/4456-311-0x0000000004B34000-0x0000000004B36000-memory.dmpFilesize
8KB
-
memory/4456-306-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/4616-274-0x0000000002B30000-0x0000000002B31000-memory.dmpFilesize
4KB
-
memory/4616-312-0x0000000002B33000-0x0000000002B34000-memory.dmpFilesize
4KB
-
memory/4616-287-0x0000000000400000-0x00000000005A2000-memory.dmpFilesize
1.6MB
-
memory/4616-283-0x00000000007B0000-0x000000000083E000-memory.dmpFilesize
568KB
-
memory/4616-280-0x0000000002B32000-0x0000000002B33000-memory.dmpFilesize
4KB
-
memory/4616-279-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/4616-284-0x0000000002A40000-0x0000000002B0D000-memory.dmpFilesize
820KB
-
memory/4616-169-0x0000000000000000-mapping.dmp
-
memory/4616-275-0x0000000002410000-0x00000000024DF000-memory.dmpFilesize
828KB
-
memory/4616-299-0x00000000028D0000-0x00000000028DB000-memory.dmpFilesize
44KB
-
memory/4616-300-0x0000000002B34000-0x0000000002B36000-memory.dmpFilesize
8KB
-
memory/4628-146-0x0000000000000000-mapping.dmp
-
memory/4628-250-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB
-
memory/4628-270-0x0000000000400000-0x0000000002B51000-memory.dmpFilesize
39.3MB
-
memory/4644-239-0x0000000000402FAB-mapping.dmp
-
memory/4644-233-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4656-117-0x0000000000000000-mapping.dmp
-
memory/4668-242-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/4668-151-0x0000000000000000-mapping.dmp
-
memory/4668-251-0x0000000005E90000-0x0000000005E91000-memory.dmpFilesize
4KB
-
memory/4668-259-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/4668-257-0x0000000005990000-0x0000000005991000-memory.dmpFilesize
4KB
-
memory/4668-255-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/4668-272-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/4668-262-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/4668-231-0x0000000077AE0000-0x0000000077C6E000-memory.dmpFilesize
1.6MB
-
memory/4712-517-0x0000000000000000-mapping.dmp
-
memory/4724-340-0x0000000004E90000-0x0000000005496000-memory.dmpFilesize
6.0MB
-
memory/4724-322-0x000000000041C5BE-mapping.dmp
-
memory/4732-197-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/4732-215-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/4732-201-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/4732-229-0x0000000000EA0000-0x00000000015E1000-memory.dmpFilesize
7.3MB
-
memory/4732-155-0x0000000000000000-mapping.dmp
-
memory/4732-206-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/4732-210-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/4732-221-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/4760-365-0x0000000000000000-mapping.dmp
-
memory/4776-248-0x0000000000000000-mapping.dmp
-
memory/4868-418-0x0000000004D30000-0x0000000005336000-memory.dmpFilesize
6.0MB
-
memory/4868-385-0x000000000041C5BA-mapping.dmp
-
memory/4936-177-0x0000000000000000-mapping.dmp
-
memory/4976-346-0x000000000041C5C2-mapping.dmp
-
memory/4976-369-0x0000000005350000-0x0000000005956000-memory.dmpFilesize
6.0MB
-
memory/5052-334-0x0000000000000000-mapping.dmp
-
memory/5060-205-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5060-194-0x0000000000000000-mapping.dmp
-
memory/5068-220-0x00000000009C0000-0x0000000000A6E000-memory.dmpFilesize
696KB
-
memory/5068-232-0x0000000000EB0000-0x0000000000EC2000-memory.dmpFilesize
72KB
-
memory/5068-207-0x0000000000000000-mapping.dmp
-
memory/5092-608-0x000000000041C5BE-mapping.dmp
-
memory/5108-398-0x000000000041C5BE-mapping.dmp
-
memory/5108-435-0x00000000055A0000-0x0000000005BA6000-memory.dmpFilesize
6.0MB
-
memory/5136-493-0x000000000041C5BE-mapping.dmp
-
memory/5164-405-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/5164-370-0x0000000000000000-mapping.dmp
-
memory/5332-526-0x000000000041C5BE-mapping.dmp
-
memory/5344-433-0x000000000041C5BA-mapping.dmp
-
memory/5344-463-0x0000000005150000-0x0000000005756000-memory.dmpFilesize
6.0MB
-
memory/5388-524-0x0000000000000000-mapping.dmp
-
memory/5428-562-0x000000000041C5C2-mapping.dmp
-
memory/5436-577-0x000000000041C5BA-mapping.dmp
-
memory/5480-446-0x000000000041C5BE-mapping.dmp
-
memory/5496-512-0x000000000041C5BA-mapping.dmp
-
memory/5704-606-0x000000000041C5C2-mapping.dmp
-
memory/5748-425-0x0000000000000000-mapping.dmp
-
memory/5776-426-0x0000000000000000-mapping.dmp
-
memory/5812-429-0x0000000000000000-mapping.dmp
-
memory/6020-476-0x000000000041C5BA-mapping.dmp
-
memory/6208-707-0x000000000041C5BE-mapping.dmp
-
memory/6308-648-0x000000000041C5C2-mapping.dmp
-
memory/6792-663-0x000000000041C5BE-mapping.dmp
-
memory/6824-664-0x000000000041C5C2-mapping.dmp
-
memory/6928-680-0x000000000041C5BA-mapping.dmp