Analysis
-
max time kernel
243s -
max time network
383s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
Software-update-patc_579570356.sfx.exe
Resource
win10-en-20210920
General
-
Target
Software-update-patc_579570356.sfx.exe
-
Size
28.5MB
-
MD5
b64a9d5a67665275d9cbb1d320f1361a
-
SHA1
3935a3994cb12a69ece3517a63eb35820761feaf
-
SHA256
28b8658e761beebef9578a13e60f231b7bd5af81107210c06ac108276e9447b9
-
SHA512
261b47e9218c1531b31ea4ba9a7aa89d5a28b7f0c4c8e4b8196acec7cbd107b31c169eb2fdcde324eeb5e8427298508d39260da82026125c199b2d146cf71d37
Malware Config
Extracted
vidar
41.5
223
https://mas.to/@xeroxxx
-
profile_id
223
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4256-294-0x000000000041852A-mapping.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3876-256-0x0000000000400000-0x00000000009A4000-memory.dmp family_vidar -
Blocklisted process makes network request 47 IoCs
Processes:
MsiExec.exepowershell.exeMsiExec.exeflow pid process 214 2184 MsiExec.exe 216 2184 MsiExec.exe 218 2184 MsiExec.exe 220 2184 MsiExec.exe 222 2184 MsiExec.exe 224 2184 MsiExec.exe 224 2184 MsiExec.exe 224 2184 MsiExec.exe 224 2184 MsiExec.exe 214 2184 MsiExec.exe 214 2184 MsiExec.exe 220 2184 MsiExec.exe 218 2184 MsiExec.exe 216 2184 MsiExec.exe 222 2184 MsiExec.exe 301 6120 powershell.exe 303 6120 powershell.exe 317 5372 MsiExec.exe 319 5372 MsiExec.exe 320 5372 MsiExec.exe 321 5372 MsiExec.exe 324 5372 MsiExec.exe 325 5372 MsiExec.exe 326 5372 MsiExec.exe 327 5372 MsiExec.exe 328 5372 MsiExec.exe 329 5372 MsiExec.exe 330 5372 MsiExec.exe 331 5372 MsiExec.exe 334 5372 MsiExec.exe 336 5372 MsiExec.exe 337 5372 MsiExec.exe 338 5372 MsiExec.exe 339 5372 MsiExec.exe 340 5372 MsiExec.exe 341 5372 MsiExec.exe 342 5372 MsiExec.exe 343 5372 MsiExec.exe 344 5372 MsiExec.exe 345 5372 MsiExec.exe 346 5372 MsiExec.exe 347 5372 MsiExec.exe 348 5372 MsiExec.exe 349 5372 MsiExec.exe 350 5372 MsiExec.exe 351 5372 MsiExec.exe 354 5372 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
DrvInst.exedescription ioc process File opened for modification C:\Windows\System32\drivers\SET67D4.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET67D4.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe -
Executes dropped EXE 64 IoCs
Processes:
ChromeRecovery.exeGoogleUpdateSetup.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeRecovery_Toolbox_For_Cd_Free_2_serial_keygen.exeGoogleUpdate.exeSoftware-update-patc_579570356.exeSoftware-update-patc_612604768.exeSoftware-update-patc_988440081.exeSoftware-update-patc_535592163.exeSoftware-update-patc_988440081.tmpSoftware-update-patc_579570356.tmpSoftware-update-patc_612604768.tmpSoftware-update-patc_535592163.tmpQuibusdam.exeExercitationem.exeVoluptatem.exeGoogleUpdate.exeGoogleUpdateSetup.exeGoogleCrashHandler.exeGoogleCrashHandler64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exea2KXkIrxs.exevpn.exekVaxcB66aQ8Sz.exevpn.tmpZembra.exeConhost.exetapinstall.exeSoftware-update-patc_579570356.exeSoftware-update-patc_579570356.tmpVoluptatem.exemask_svc.exemask_svc.exemask_svc.exeZembraBro.exepHyDo.exepHyDo.exeZembraBro.exeaipackagechainer.exeWeather_Installation.exeSoftware-update-patc_579570356.exeSoftware-update-patc_579570356.tmpVoluptatem.exeSoftware-update-patc_535592163.exeSoftware-update-patc_535592163.tmpExercitationem.exeWeather.exe0KwCmzNvL.exeWeather.exeWeather.exeWeather.exepid process 3536 ChromeRecovery.exe 4356 GoogleUpdateSetup.exe 4336 GoogleUpdate.exe 1756 GoogleUpdate.exe 2872 GoogleUpdate.exe 4108 GoogleUpdateComRegisterShell64.exe 3576 GoogleUpdateComRegisterShell64.exe 4388 GoogleUpdateComRegisterShell64.exe 2452 GoogleUpdate.exe 3920 Recovery_Toolbox_For_Cd_Free_2_serial_keygen.exe 3792 GoogleUpdate.exe 4780 Software-update-patc_579570356.exe 4764 Software-update-patc_612604768.exe 4804 Software-update-patc_988440081.exe 4788 Software-update-patc_535592163.exe 4504 Software-update-patc_988440081.tmp 4940 Software-update-patc_579570356.tmp 4904 Software-update-patc_612604768.tmp 4848 Software-update-patc_535592163.tmp 5044 Quibusdam.exe 5020 Exercitationem.exe 4928 Voluptatem.exe 1644 GoogleUpdate.exe 1036 GoogleUpdateSetup.exe 4196 GoogleCrashHandler.exe 2176 GoogleCrashHandler64.exe 2924 GoogleUpdate.exe 2504 GoogleUpdate.exe 416 GoogleUpdate.exe 4120 GoogleUpdate.exe 4404 GoogleUpdateComRegisterShell64.exe 4420 GoogleUpdateComRegisterShell64.exe 1476 GoogleUpdateComRegisterShell64.exe 3116 GoogleUpdate.exe 1872 a2KXkIrxs.exe 4068 vpn.exe 5028 kVaxcB66aQ8Sz.exe 4620 vpn.tmp 3876 Zembra.exe 1744 Conhost.exe 4832 tapinstall.exe 1376 Software-update-patc_579570356.exe 1776 Software-update-patc_579570356.tmp 3252 Voluptatem.exe 804 mask_svc.exe 668 mask_svc.exe 4340 mask_svc.exe 4820 ZembraBro.exe 4168 pHyDo.exe 156 pHyDo.exe 4256 ZembraBro.exe 5588 aipackagechainer.exe 5672 Weather_Installation.exe 5708 Software-update-patc_579570356.exe 5744 Software-update-patc_579570356.tmp 5796 Voluptatem.exe 5900 Software-update-patc_535592163.exe 5924 Software-update-patc_535592163.tmp 5952 Exercitationem.exe 6068 Weather.exe 5492 0KwCmzNvL.exe 4408 Weather.exe 2476 Weather.exe 4228 Weather.exe -
Sets file execution options in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Zembra.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Zembra.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Zembra.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a2KXkIrxs.exeWeather.exeWeather.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation a2KXkIrxs.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Weather.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Weather.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Zembra.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Wine Zembra.exe -
Loads dropped DLL 64 IoCs
Processes:
GoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdate.exeSoftware-update-patc_579570356.tmpSoftware-update-patc_988440081.tmpSoftware-update-patc_612604768.tmpSoftware-update-patc_535592163.tmpGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exekVaxcB66aQ8Sz.exevpn.tmpMsiExec.exeMsiExec.exeSoftware-update-patc_579570356.tmpZembra.exemask_svc.exeWeather_Installation.exeSoftware-update-patc_579570356.tmppid process 4336 GoogleUpdate.exe 1756 GoogleUpdate.exe 2872 GoogleUpdate.exe 4108 GoogleUpdateComRegisterShell64.exe 2872 GoogleUpdate.exe 3576 GoogleUpdateComRegisterShell64.exe 2872 GoogleUpdate.exe 4388 GoogleUpdateComRegisterShell64.exe 2872 GoogleUpdate.exe 2452 GoogleUpdate.exe 3792 GoogleUpdate.exe 4940 Software-update-patc_579570356.tmp 4504 Software-update-patc_988440081.tmp 4904 Software-update-patc_612604768.tmp 4848 Software-update-patc_535592163.tmp 1644 GoogleUpdate.exe 1644 GoogleUpdate.exe 3792 GoogleUpdate.exe 2924 GoogleUpdate.exe 2504 GoogleUpdate.exe 416 GoogleUpdate.exe 4120 GoogleUpdate.exe 4404 GoogleUpdateComRegisterShell64.exe 4120 GoogleUpdate.exe 4420 GoogleUpdateComRegisterShell64.exe 4120 GoogleUpdate.exe 1476 GoogleUpdateComRegisterShell64.exe 4120 GoogleUpdate.exe 3116 GoogleUpdate.exe 5028 kVaxcB66aQ8Sz.exe 4620 vpn.tmp 4620 vpn.tmp 3140 MsiExec.exe 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 3140 MsiExec.exe 4620 vpn.tmp 4620 vpn.tmp 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 2184 MsiExec.exe 1776 Software-update-patc_579570356.tmp 2184 MsiExec.exe 3876 Zembra.exe 3876 Zembra.exe 4340 mask_svc.exe 4340 mask_svc.exe 4340 mask_svc.exe 4340 mask_svc.exe 4340 mask_svc.exe 4340 mask_svc.exe 4620 vpn.tmp 4620 vpn.tmp 5672 Weather_Installation.exe 5672 Weather_Installation.exe 5744 Software-update-patc_579570356.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
aipackagechainer.exeWeather_Installation.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Weather_Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Weather = "C:\\Users\\Admin\\AppData\\Roaming\\Weather\\Weather.exe --U4miRxC" Weather_Installation.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Zembra.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Zembra.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
kVaxcB66aQ8Sz.exemsiexec.exe0KwCmzNvL.exedescription ioc process File opened (read-only) \??\I: kVaxcB66aQ8Sz.exe File opened (read-only) \??\Z: kVaxcB66aQ8Sz.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: 0KwCmzNvL.exe File opened (read-only) \??\N: 0KwCmzNvL.exe File opened (read-only) \??\M: 0KwCmzNvL.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: 0KwCmzNvL.exe File opened (read-only) \??\K: kVaxcB66aQ8Sz.exe File opened (read-only) \??\M: kVaxcB66aQ8Sz.exe File opened (read-only) \??\O: 0KwCmzNvL.exe File opened (read-only) \??\H: kVaxcB66aQ8Sz.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: 0KwCmzNvL.exe File opened (read-only) \??\S: 0KwCmzNvL.exe File opened (read-only) \??\Y: 0KwCmzNvL.exe File opened (read-only) \??\Q: kVaxcB66aQ8Sz.exe File opened (read-only) \??\R: kVaxcB66aQ8Sz.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: 0KwCmzNvL.exe File opened (read-only) \??\U: 0KwCmzNvL.exe File opened (read-only) \??\X: 0KwCmzNvL.exe File opened (read-only) \??\U: kVaxcB66aQ8Sz.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: kVaxcB66aQ8Sz.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: 0KwCmzNvL.exe File opened (read-only) \??\T: kVaxcB66aQ8Sz.exe File opened (read-only) \??\F: 0KwCmzNvL.exe File opened (read-only) \??\J: 0KwCmzNvL.exe File opened (read-only) \??\W: 0KwCmzNvL.exe File opened (read-only) \??\Z: 0KwCmzNvL.exe File opened (read-only) \??\B: kVaxcB66aQ8Sz.exe File opened (read-only) \??\S: kVaxcB66aQ8Sz.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: 0KwCmzNvL.exe File opened (read-only) \??\L: 0KwCmzNvL.exe File opened (read-only) \??\F: kVaxcB66aQ8Sz.exe File opened (read-only) \??\W: kVaxcB66aQ8Sz.exe File opened (read-only) \??\X: kVaxcB66aQ8Sz.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: 0KwCmzNvL.exe File opened (read-only) \??\A: kVaxcB66aQ8Sz.exe File opened (read-only) \??\N: kVaxcB66aQ8Sz.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: kVaxcB66aQ8Sz.exe File opened (read-only) \??\J: kVaxcB66aQ8Sz.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: 0KwCmzNvL.exe File opened (read-only) \??\R: 0KwCmzNvL.exe File opened (read-only) \??\T: 0KwCmzNvL.exe File opened (read-only) \??\L: kVaxcB66aQ8Sz.exe File opened (read-only) \??\O: kVaxcB66aQ8Sz.exe File opened (read-only) \??\P: kVaxcB66aQ8Sz.exe File opened (read-only) \??\O: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 17 IoCs
Processes:
DrvInst.exetaskkill.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\tap0901.cat taskkill.exe File created C:\Windows\System32\DriverStore\drvstore.tmp taskkill.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf taskkill.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543} taskkill.exe File created C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\SET64C9.tmp taskkill.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\tap0901.sys taskkill.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\SET64B7.tmp taskkill.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\SET64B8.tmp taskkill.exe File created C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\SET64B8.tmp taskkill.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\SET64C9.tmp taskkill.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys taskkill.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat taskkill.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt taskkill.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF File created C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\SET64B7.tmp taskkill.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{707ad77c-7d80-6d45-bf7b-5f14425a0543}\oemvista.inf taskkill.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
Zembra.exemask_svc.exemask_svc.exemask_svc.exepid process 3876 Zembra.exe 804 mask_svc.exe 668 mask_svc.exe 4340 mask_svc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
pHyDo.exeZembraBro.exedescription pid process target process PID 4168 set thread context of 156 4168 pHyDo.exe pHyDo.exe PID 4820 set thread context of 4256 4820 ZembraBro.exe ZembraBro.exe -
Drops file in Program Files directory 64 IoCs
Processes:
GoogleUpdateSetup.exeGoogleUpdate.exeSoftware-update-patc_535592163.tmpGoogleUpdate.exeSoftware-update-patc_579570356.tmpvpn.tmpGoogleUpdateSetup.exeSoftware-update-patc_579570356.tmpSoftware-update-patc_579570356.tmpelevation_service.exeSoftware-update-patc_612604768.tmpSoftware-update-patc_535592163.tmpdescription ioc process File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_fil.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_sv.dll GoogleUpdate.exe File created C:\Program Files (x86)\Ut\magni\is-PVE5U.tmp Software-update-patc_535592163.tmp File created C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe GoogleUpdate.exe File created C:\Program Files (x86)\Autem\is-8RBDL.tmp Software-update-patc_579570356.tmp File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_et.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_tr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_sl.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_ur.dll GoogleUpdate.exe File created C:\Program Files (x86)\MaskVPN\is-J1GHS.tmp vpn.tmp File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\GoogleUpdateBroker.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_el.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_sw.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\psuser.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_pt-BR.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Autem\is-FQJC4.tmp Software-update-patc_579570356.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-0P4CL.tmp vpn.tmp File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_fr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_pl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Autem\eaque\is-HPAQO.tmp Software-update-patc_579570356.tmp File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_pt-BR.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_no.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_lt.dll GoogleUpdate.exe File opened for modification C:\Program Files (x86)\MaskVPN\libCommon.dll vpn.tmp File created C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_is.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_kn.dll GoogleUpdate.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\ChromeRecovery.exe elevation_service.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_iw.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_hi.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_zh-TW.dll GoogleUpdate.exe File created C:\Program Files (x86)\Autem\eaque\is-VN1BG.tmp Software-update-patc_579570356.tmp File created C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateSetup.exe GoogleUpdate.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-1QC5V.tmp vpn.tmp File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_ms.dll GoogleUpdate.exe File created C:\Program Files (x86)\Ut\sed\is-G9PH6.tmp Software-update-patc_535592163.tmp File created C:\Program Files (x86)\Dolore\quos\is-AHL9C.tmp Software-update-patc_612604768.tmp File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_zh-CN.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-B55RA.tmp vpn.tmp File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_ur.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_id.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_nl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ko.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_hi.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_zh-CN.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\goopdateres_sr.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.111\psmachine_64.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_sl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_sr.dll GoogleUpdate.exe File created C:\Program Files (x86)\Dolore\is-TRI1G.tmp Software-update-patc_612604768.tmp File created C:\Program Files (x86)\Google\Temp\GUM37D.tmp\goopdateres_sv.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_it.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_ta.dll GoogleUpdate.exe File created C:\Program Files (x86)\MaskVPN\is-OBDEN.tmp vpn.tmp File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdate.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Ut\quam\is-7IKQA.tmp Software-update-patc_535592163.tmp File created C:\Program Files (x86)\Google\Update\1.3.36.112\goopdateres_et.dll GoogleUpdate.exe File created C:\Program Files (x86)\Ut\quia\is-MGQGF.tmp Software-update-patc_535592163.tmp File created C:\Program Files (x86)\Ut\quia\is-4BK07.tmp Software-update-patc_535592163.tmp File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdateBroker.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\psuser_64.dll GoogleUpdateSetup.exe -
Drops file in Windows directory 58 IoCs
Processes:
msiexec.exetaskkill.exesvchost.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeDrvInst.exetapinstall.exedescription ioc process File opened for modification C:\Windows\Installer\f785ae4.msi msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File created C:\Windows\Installer\f785ae8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5E7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6095.tmp msiexec.exe File opened for modification C:\Windows\inf\oem2.inf taskkill.exe File opened for modification C:\Windows\Installer\MSI6626.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI60F4.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSI4C67.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4D44.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log taskkill.exe File opened for modification C:\Windows\Installer\MSI5309.tmp msiexec.exe File created C:\Windows\inf\oem2.inf taskkill.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\f785ae8.msi msiexec.exe File created C:\Windows\Installer\f785ae4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6646.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI526B.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI4D14.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4E23.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI521C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A35.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI5FE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4D64.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5443.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6AFC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5791.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI591A.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4DE3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5150.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5413.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5AC2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI6025.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6615.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI683B.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI58DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5CB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6065.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\Installer\MSI59A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5B12.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\Installer\MSID4F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4D84.tmp msiexec.exe File created C:\Windows\Installer\f785aeb.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Conhost.exesvchost.exesvchost.exetapinstall.exetaskkill.exeDrvInst.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs Conhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 Conhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 Conhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom taskkill.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Zembra.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Zembra.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Zembra.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1864 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 4808 taskkill.exe 5192 taskkill.exe 5212 taskkill.exe -
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mask_svc.exetaskkill.exemsiexec.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-491 = "India Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing taskkill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" mask_svc.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs taskkill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" mask_svc.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed taskkill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople taskkill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA taskkill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs taskkill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs taskkill.exe -
Modifies registry class 64 IoCs
Processes:
GoogleUpdateComRegisterShell64.exeGoogleUpdate.exeMicrosoftEdge.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdate.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exeGoogleUpdateComRegisterShell64.exemsiexec.exeGoogleUpdate.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ = "IPackage" GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\LocalServer32 GoogleUpdate.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.111\\goopdate.dll,-3000" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ = "ICoCreateAsync" GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\ = "6" GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69} GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ = "ICredentialDialog" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods\ = "16" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods\ = "16" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ = "IAppCommandWeb" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\ = "Google Update Core Class" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8324F243-250C-4E97-915C-8220BAE15E18}\InprocHandler32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ = "IGoogleUpdate3WebSecurity" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\Elevation\Enabled = "1" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}" GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8324F243-250C-4E97-915C-8220BAE15E18}\InprocHandler32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods\ = "4" GoogleUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D} GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\ = "{A3ADC43E-56D9-4EC1-ADDA-49C5B9069B07}" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.111\\psmachine_64.dll" GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\ = "10" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ = "IPolicyStatus3" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ = "IPolicyStatus3" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ = "IGoogleUpdate3" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.111\\goopdate.dll,-1004" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57} GoogleUpdateComRegisterShell64.exe -
Processes:
kVaxcB66aQ8Sz.exevpn.tmpa2KXkIrxs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 kVaxcB66aQ8Sz.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 kVaxcB66aQ8Sz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E kVaxcB66aQ8Sz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd kVaxcB66aQ8Sz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703085c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e kVaxcB66aQ8Sz.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B kVaxcB66aQ8Sz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd kVaxcB66aQ8Sz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd kVaxcB66aQ8Sz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 a2KXkIrxs.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a2KXkIrxs.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd kVaxcB66aQ8Sz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeGoogleUpdate.exeGoogleUpdate.exeSoftware-update-patc_535592163.tmpSoftware-update-patc_579570356.tmpSoftware-update-patc_612604768.tmpSoftware-update-patc_988440081.tmpQuibusdam.exechrome.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exevpn.tmppid process 1244 chrome.exe 1244 chrome.exe 1952 chrome.exe 1952 chrome.exe 1960 chrome.exe 1960 chrome.exe 2872 chrome.exe 2872 chrome.exe 4632 chrome.exe 4632 chrome.exe 4744 chrome.exe 4744 chrome.exe 4784 chrome.exe 4784 chrome.exe 4972 chrome.exe 4972 chrome.exe 2472 chrome.exe 2472 chrome.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 4336 GoogleUpdate.exe 2452 GoogleUpdate.exe 2452 GoogleUpdate.exe 4848 Software-update-patc_535592163.tmp 4848 Software-update-patc_535592163.tmp 4940 Software-update-patc_579570356.tmp 4940 Software-update-patc_579570356.tmp 4904 Software-update-patc_612604768.tmp 4904 Software-update-patc_612604768.tmp 4504 Software-update-patc_988440081.tmp 4504 Software-update-patc_988440081.tmp 5044 Quibusdam.exe 5044 Quibusdam.exe 4156 chrome.exe 4156 chrome.exe 4156 chrome.exe 4156 chrome.exe 3792 GoogleUpdate.exe 3792 GoogleUpdate.exe 1644 GoogleUpdate.exe 1644 GoogleUpdate.exe 2924 GoogleUpdate.exe 2924 GoogleUpdate.exe 2504 GoogleUpdate.exe 2504 GoogleUpdate.exe 2504 GoogleUpdate.exe 2504 GoogleUpdate.exe 2504 GoogleUpdate.exe 2504 GoogleUpdate.exe 3116 GoogleUpdate.exe 3116 GoogleUpdate.exe 5044 Quibusdam.exe 5044 Quibusdam.exe 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
MicrosoftEdgeCP.exepid process 2352 MicrosoftEdgeCP.exe 2352 MicrosoftEdgeCP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
Processes:
chrome.exepid process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
GoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exeGoogleCrashHandler.exeGoogleCrashHandler64.exeGoogleUpdate.exeGoogleUpdate.exeGoogleUpdate.exevpn.tmpmsiexec.exekVaxcB66aQ8Sz.exedescription pid process Token: SeDebugPrivilege 4336 GoogleUpdate.exe Token: SeDebugPrivilege 4336 GoogleUpdate.exe Token: SeDebugPrivilege 4336 GoogleUpdate.exe Token: SeDebugPrivilege 4336 GoogleUpdate.exe Token: SeDebugPrivilege 2452 GoogleUpdate.exe Token: SeDebugPrivilege 3792 GoogleUpdate.exe Token: SeDebugPrivilege 1644 GoogleUpdate.exe Token: 33 4196 GoogleCrashHandler.exe Token: SeIncBasePriorityPrivilege 4196 GoogleCrashHandler.exe Token: 33 2176 GoogleCrashHandler64.exe Token: SeIncBasePriorityPrivilege 2176 GoogleCrashHandler64.exe Token: SeDebugPrivilege 2924 GoogleUpdate.exe Token: SeDebugPrivilege 2504 GoogleUpdate.exe Token: SeDebugPrivilege 2504 GoogleUpdate.exe Token: SeDebugPrivilege 2504 GoogleUpdate.exe Token: SeDebugPrivilege 3116 GoogleUpdate.exe Token: SeDebugPrivilege 4620 vpn.tmp Token: SeSecurityPrivilege 5060 msiexec.exe Token: SeCreateTokenPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeAssignPrimaryTokenPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeLockMemoryPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeIncreaseQuotaPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeMachineAccountPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeTcbPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSecurityPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeTakeOwnershipPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeLoadDriverPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSystemProfilePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSystemtimePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeProfSingleProcessPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeIncBasePriorityPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeCreatePagefilePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeCreatePermanentPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeBackupPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeRestorePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeShutdownPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeDebugPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeAuditPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSystemEnvironmentPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeChangeNotifyPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeRemoteShutdownPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeUndockPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSyncAgentPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeEnableDelegationPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeManageVolumePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeImpersonatePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeCreateGlobalPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeCreateTokenPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeAssignPrimaryTokenPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeLockMemoryPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeIncreaseQuotaPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeMachineAccountPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeTcbPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSecurityPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeTakeOwnershipPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeLoadDriverPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSystemProfilePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeSystemtimePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeProfSingleProcessPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeIncBasePriorityPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeCreatePagefilePrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeCreatePermanentPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeBackupPrivilege 5028 kVaxcB66aQ8Sz.exe Token: SeRestorePrivilege 5028 kVaxcB66aQ8Sz.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeRecovery_Toolbox_For_Cd_Free_2_serial_keygen.exeSoftware-update-patc_535592163.tmpSoftware-update-patc_579570356.tmpSoftware-update-patc_988440081.tmpSoftware-update-patc_612604768.tmpkVaxcB66aQ8Sz.exevpn.tmppid process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 3920 Recovery_Toolbox_For_Cd_Free_2_serial_keygen.exe 4848 Software-update-patc_535592163.tmp 4940 Software-update-patc_579570356.tmp 4504 Software-update-patc_988440081.tmp 4904 Software-update-patc_612604768.tmp 5028 kVaxcB66aQ8Sz.exe 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp 4620 vpn.tmp -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
Software-update-patc_579570356.sfx.exeOpenWith.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeOpenWith.exepid process 4068 Software-update-patc_579570356.sfx.exe 4068 Software-update-patc_579570356.sfx.exe 2252 OpenWith.exe 2504 MicrosoftEdge.exe 2352 MicrosoftEdgeCP.exe 2352 MicrosoftEdgeCP.exe 4120 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1952 wrote to memory of 3476 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 3476 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1124 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1244 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 1244 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe PID 1952 wrote to memory of 2028 1952 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Software-update-patc_579570356.sfx.exe"C:\Users\Admin\AppData\Local\Temp\Software-update-patc_579570356.sfx.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff95b5c4f50,0x7ff95b5c4f60,0x7ff95b5c4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1600 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1884 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4348 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5548 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7eceba890,0x7ff7eceba8a0,0x7ff7eceba8b03⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5664 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5672 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4952 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4476 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2868 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,9322226218696501620,8977180637948738087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={48f4ad4f-de59-4d9a-8485-e2123e98b16a} --system2⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\GoogleUpdateSetup.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\GoogleUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjE5RUJCNDAtMzAyRi00MDM0LUFFMTItMzlFMTdDMUFCRDBBfSIgdXNlcmlkPSJ7NjM1RkVBQjctM0I5Ny00NDlBLTgwNUEtQzIzQTc3REZCNTc4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezZBMzU3QUJFLTIxRjktNDJDRS04NUZCLURERDNEQzIzMkY1Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMCIgc3NlNDE9IjAiIHNzZTQyPSIwIiBhdng9IjAiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNjU2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /machine /installsource chromerecovery3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Recovery_Toolbox_For_Cd_Free_2_serial_keygen.exe"C:\Users\Admin\Desktop\Recovery_Toolbox_For_Cd_Free_2_serial_keygen.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-F4I0G.tmp\Software-update-patc_579570356.tmp"C:\Users\Admin\AppData\Local\Temp\is-F4I0G.tmp\Software-update-patc_579570356.tmp" /SL5="$401E8,4499537,466944,C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Autem\rerum\Voluptatem.exe"C:\Program Files (x86)\Autem/\rerum\Voluptatem.exe" b0ad3d01dc1c01fd7e87a06144c12f593⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-OP9N9.tmp\Software-update-patc_535592163.tmp"C:\Users\Admin\AppData\Local\Temp\is-OP9N9.tmp\Software-update-patc_535592163.tmp" /SL5="$10232,4479401,466944,C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Ut\quam\Exercitationem.exe"C:\Program Files (x86)\Ut/\quam\Exercitationem.exe" 8208c5e16842608234b91821ef4b1c3f3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Software-update-patc_988440081.exe"C:\Users\Admin\Desktop\Software-update-patc_988440081.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-VSCMO.tmp\Software-update-patc_988440081.tmp"C:\Users\Admin\AppData\Local\Temp\is-VSCMO.tmp\Software-update-patc_988440081.tmp" /SL5="$401F0,4479401,466944,C:\Users\Admin\Desktop\Software-update-patc_988440081.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Software-update-patc_612604768.exe"C:\Users\Admin\Desktop\Software-update-patc_612604768.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-AM5MA.tmp\Software-update-patc_612604768.tmp"C:\Users\Admin\AppData\Local\Temp\is-AM5MA.tmp\Software-update-patc_612604768.tmp" /SL5="$90080,4477466,466944,C:\Users\Admin\Desktop\Software-update-patc_612604768.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Dolore\quia\Quibusdam.exe"C:\Program Files (x86)\Dolore/\quia\Quibusdam.exe" 2fe3d428284ff9b385bc1c941892777b3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\aaK02McC\a2KXkIrxs.exeC:\Users\Admin\AppData\Local\Temp\aaK02McC\a2KXkIrxs.exe /VERYSILENT4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\Zembra.exeC:\Users\Admin\AppData\Local\Temp\Zembra.exe5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Zembra.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Zembra.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Zembra.exe /f7⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Kills process with taskkill
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\ZembraBro.exeC:\Users\Admin\AppData\Local\Temp\ZembraBro.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\ZembraBro.exeC:\Users\Admin\AppData\Local\Temp\ZembraBro.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\aaK02McC\a2KXkIrxs.exe & exit5⤵
-
C:\Windows\SysWOW64\PING.EXEping 06⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\oTXcI8WN\vpn.exeC:\Users\Admin\AppData\Local\Temp\oTXcI8WN\vpn.exe /silent /subid=510x2fe3d428284ff9b385bc1c941892777b4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-2C3SB.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-2C3SB.tmp\vpn.tmp" /SL5="$10398,15170975,270336,C:\Users\Admin\AppData\Local\Temp\oTXcI8WN\vpn.exe" /silent /subid=510x2fe3d428284ff9b385bc1c941892777b5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "6⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09017⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "6⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09017⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\SwkT9WcS\kVaxcB66aQ8Sz.exeC:\Users\Admin\AppData\Local\Temp\SwkT9WcS\kVaxcB66aQ8Sz.exe /quiet SILENT=1 AF=606x2fe3d428284ff9b385bc1c941892777b4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=606x2fe3d428284ff9b385bc1c941892777b AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\SwkT9WcS\kVaxcB66aQ8Sz.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\SwkT9WcS\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634482991 /quiet SILENT=1 AF=606x2fe3d428284ff9b385bc1c941892777b " AF="606x2fe3d428284ff9b385bc1c941892777b" AI_EXTEND_GLASS="26"5⤵
-
C:\Users\Admin\AppData\Local\Temp\QQPkq2IX\pHyDo.exeC:\Users\Admin\AppData\Local\Temp\QQPkq2IX\pHyDo.exe /usthree SUB=2fe3d428284ff9b385bc1c941892777b4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\QQPkq2IX\pHyDo.exeC:\Users\Admin\AppData\Local\Temp\QQPkq2IX\pHyDo.exe /usthree SUB=2fe3d428284ff9b385bc1c941892777b5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "pHyDo.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\QQPkq2IX\pHyDo.exe" & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "pHyDo.exe" /f7⤵
- Kills process with taskkill
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\Install\{1FAC0F7E-0E67-4FFF-92B1-706480719EC9}\GoogleUpdateSetup.exe"C:\Program Files (x86)\Google\Update\Install\{1FAC0F7E-0E67-4FFF-92B1-706480719EC9}\GoogleUpdateSetup.exe" /update /sessionid "{BA22C6C7-380A-493F-8131-FAEF053DFA5E}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Temp\GUM37D.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUM37D.tmp\GoogleUpdate.exe" /update /sessionid "{BA22C6C7-380A-493F-8131-FAEF053DFA5E}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkEyMkM2QzctMzgwQS00OTNGLTgxMzEtRkFFRjA1M0RGQTVFfSIgdXNlcmlkPSJ7NjM1RkVBQjctM0I5Ny00NDlBLTgwNUEtQzIzQTc3REZCNTc4fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7RTlFQjVBMDEtQzAwMy00RTA3LTkzQzYtNEI0ODE4OTkwREQxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI0IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIwIiBzc2U0MT0iMCIgc3NlNDI9IjAiIGF2eD0iMCIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMTExIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjExMiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjE0MlIiIGluc3RhbGxhZ2U9IjMwIiBpbnN0YWxsZGF0ZT0iNTQwNCIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.111\GoogleCrashHandler64.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkEyMkM2QzctMzgwQS00OTNGLTgxMzEtRkFFRjA1M0RGQTVFfSIgdXNlcmlkPSJ7NjM1RkVBQjctM0I5Ny00NDlBLTgwNUEtQzIzQTc3REZCNTc4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0ie0ZEODg4NDVBLTg3NjktNERDMy04QTE1LTA4RUZERDZCQjA1MX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iNCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMCIgc3NlNDE9IjAiIHNzZTQyPSIwIiBhdng9IjAiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjExMSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMTIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIxNDJSIiBpbnN0YWxsYWdlPSIzMCIgaWlkPSJ7OEQ4QjE0NjAtMzA3NS00RjI3LUQ4MzEtOEMwMTU3QkIzNjYwfSIgY29ob3J0PSIxOjljbzoiIGNvaG9ydG5hbWU9IkV2ZXJ5b25lIEVsc2UiPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi91cGRhdGUyL2FkeG1vbWZ0cmtvaW9kazdhd3l2YTNtejZ1dGFfMS4zLjM2LjExMi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEzNDEyNzIiIHRvdGFsPSIxMzQxMjcyIiBkb3dubG9hZF90aW1lX21zPSI0MDYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzQy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjE0MlIiIGluc3RhbGxhZ2U9IjMwIiBpaWQ9Ins4RDhCMTQ2MC0zMDc1LTRGMjctRDgzMS04QzAxNTdCQjM2NjB9Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iOSIgZXJyb3Jjb2RlPSItMTYwNjIxOTc0OCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B097B89D5D27BD1AEF1C745AAE91A464 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C79964112A680D6D15617D7A482C5B7C2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=606x2fe3d428284ff9b385bc1c941892777b -BF=default -uncf=default3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--U4miRxC"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff95b6b9ec0,0x7ff95b6b9ed0,0x7ff95b6b9ee05⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff647ee4e60,0x7ff647ee4e70,0x7ff647ee4e806⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --mojo-platform-channel-handle=1676 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1596 /prefetch:25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --mojo-platform-channel-handle=2152 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2640 /prefetch:15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1596 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --mojo-platform-channel-handle=2772 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,1223688135763691643,14164796126659753684,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6068_1558291399" --mojo-platform-channel-handle=3548 /prefetch:85⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_2FA8.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"3⤵
- Blocklisted process makes network request
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 49E8D0F5892E92B79214B9B001F38BEC C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1AA60597E8426EE98190D4C15A0DE9E2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A6028EDAB2F274294F557870F02FE314 E Global\MSI00002⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5daacba6-050a-1b43-a503-5e3de654df5d}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-CPM0J.tmp\Software-update-patc_579570356.tmp"C:\Users\Admin\AppData\Local\Temp\is-CPM0J.tmp\Software-update-patc_579570356.tmp" /SL5="$801F0,4499537,466944,C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\Autem\rerum\Voluptatem.exe"C:\Program Files (x86)\Autem/\rerum\Voluptatem.exe" b0ad3d01dc1c01fd7e87a06144c12f593⤵
- Executes dropped EXE
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
-
C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-5TV69.tmp\Software-update-patc_579570356.tmp"C:\Users\Admin\AppData\Local\Temp\is-5TV69.tmp\Software-update-patc_579570356.tmp" /SL5="$6026A,4499537,466944,C:\Users\Admin\Desktop\Software-update-patc_579570356.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\Autem\rerum\Voluptatem.exe"C:\Program Files (x86)\Autem/\rerum\Voluptatem.exe" b0ad3d01dc1c01fd7e87a06144c12f593⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3pZaxAgN\0KwCmzNvL.exeC:\Users\Admin\AppData\Local\Temp\3pZaxAgN\0KwCmzNvL.exe /qn CAMPAIGN="642"4⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=642 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3pZaxAgN\0KwCmzNvL.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\3pZaxAgN\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634482991 /qn CAMPAIGN=""642"" " CAMPAIGN="642"5⤵
-
C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-OOKQI.tmp\Software-update-patc_535592163.tmp"C:\Users\Admin\AppData\Local\Temp\is-OOKQI.tmp\Software-update-patc_535592163.tmp" /SL5="$100112,4479401,466944,C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Ut\quam\Exercitationem.exe"C:\Program Files (x86)\Ut/\quam\Exercitationem.exe" 8208c5e16842608234b91821ef4b1c3f3⤵
- Executes dropped EXE
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-16ABT.tmp\Software-update-patc_535592163.tmp"C:\Users\Admin\AppData\Local\Temp\is-16ABT.tmp\Software-update-patc_535592163.tmp" /SL5="$8030A,4479401,466944,C:\Users\Admin\Desktop\Software-update-patc_535592163.exe"2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Ut\quam\Exercitationem.exe"C:\Program Files (x86)\Ut/\quam\Exercitationem.exe" 8208c5e16842608234b91821ef4b1c3f3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleCrashHandler.exeMD5
02df1e835008ceb9ae725661c10ce5b0
SHA1947a182253038c52196972d6e120ec2d4146e2ce
SHA256413771b6008a8586383a918019345e431e576cc0f3638dff2fa7af73311de507
SHA512c72326cbaffb1c3087a3b525dd670872162ccf5552f398deefec421a278770a1ebffdc9f1978528f03f52f3e7fc5ecbefee755ed4ce4b0a06549e4889bcb0d74
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleCrashHandler64.exeMD5
927575e60a8c1864b0276a8b5473028a
SHA1f50a215ae8cf5c7bfa83f18275ab5eafe1c9268c
SHA256070875d941aaf2a4a01cd61dfbd1f7122b9bc4b6030341999e4c1aadcf93f271
SHA51240e4564ef65e1d093a43784a97b90f1da14cdabae0935b5f65c36992b3bf4294c7c61865c61c27db3dc40c0b2ce905b7d2a1dee5987fe29e306ab854eb4eebb8
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdate.exeMD5
6bf197b8c7de4b004c5d6fa415fc7867
SHA128f84c220ba321960687a80b79d7860b767a0960
SHA25661a92167587e540275b374890be8fd0319fe03c4f19cc79a8c2fb6871cf21e73
SHA512d7a3dd059ddae20a09c00738f20720caeeb026368dfcfdf4103d433121a236780c37efd89cd6dcc15f6c3aeae5a3d29178498435cc5a2506e1e674ba155986f6
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdate.exeMD5
6bf197b8c7de4b004c5d6fa415fc7867
SHA128f84c220ba321960687a80b79d7860b767a0960
SHA25661a92167587e540275b374890be8fd0319fe03c4f19cc79a8c2fb6871cf21e73
SHA512d7a3dd059ddae20a09c00738f20720caeeb026368dfcfdf4103d433121a236780c37efd89cd6dcc15f6c3aeae5a3d29178498435cc5a2506e1e674ba155986f6
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdateComRegisterShell64.exeMD5
3e71eef771c1753baed00d207b3f77f5
SHA1e8134a9be82f5fc1789a7fdfc38613ad8a7c5e33
SHA256c49b42e079880fc4d12a9c1c8a9e66b12e0d6675a8777c1d83a9fd6e958ba0aa
SHA5125a53349047f334115bb635b45c91b2ceb7415e76563e94ba184e42912c8efea826b69fa19d27c4f985ce243d9cecfbec8d6521f641dc8c15c550d492fc2b6b42
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\GoogleUpdateCore.exeMD5
dad2ffee93ff66cd7771d4894e3a02be
SHA1e849f1be20ab2c9f2dc3d31d9954cda45552d6a3
SHA2567c5a8417300793b5aeddbf9f3f45ed81f2bff8b435866ef73092759e0da85239
SHA5129b13c01a288e136c1675ebf9c1522296f78e4852be3aa0d0a8d63daf9401e0ec0d9cfa52e63e611ec9e9957aa60c883452894661f69421d49538d8ed0160ccb3
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdate.dllMD5
ff8eafc8c23ccbb8cf755f189fa6fdc3
SHA12e7e358d717dc9d190659b2f131c156c9327ab25
SHA25658ea125a6d6a7bbd68fb8d2332618a7218bd5893e9e91b5f60d3ad422cd5c4bc
SHA5124dc7e50aacf7c08a30380a7a7d64fdbaf6d015cae7495f293f0a97daec270512f83695936a095ae8161c3a120221d8d61ae49e04866dd41935c49e4b81052d04
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_am.dllMD5
109c80f37355269b643fcc2a1b80944d
SHA1819fea334af9129304c9e73a42377c7dc5561aaa
SHA25646d099b45f1842d56e56c073845c4c492a8f1cd9bc8cfce80ff4593a08b8c333
SHA512eef3c16e9de1dad3ff2195c60a3214110851e1fdf78ea1d17c6a1138c57158bd054b269a28069247c8db5220ad5a092d03ec5141fc33dbbd16e72236411d3f86
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_ar.dllMD5
c2de128e052b029194847d18e9f561ab
SHA1fc55fadaea0f16c1839722435699f1b5373dda4b
SHA256cd2b966cb475339b63b75f09fb60feddadaa36b77f4db75fa15b8e7495fea518
SHA512288b4edeba6c79e2a2bca96bc69fec42e6901b6e2fb202d421c696c0c242fb89fc314fa7e4561c6a20380ceb5cabe8245128ea181eb3e81840e6e10555cf41a3
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_bg.dllMD5
6d905790f32d62cb030c251daa06e7b3
SHA1fac6465cd06a4106ccba01330c3838583cb5f35d
SHA256e9ad06d267ac44a30ee71b05b84e5e3c76fe6a5a9194a2518383795c6b8e5f15
SHA512886771ed41dc8e8c14e25c49314e361e15e6b06a82cd41b804018ffeff9056a8e28f0c883c48046c18120ab615aa9017cfe4db064bac629ee3fb456a8b2993b0
-
C:\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdateres_en.dllMD5
56b0c4d41d5e7af4f8f6354d55bd255d
SHA171009f8bab8d95734f6d13d322039e345863a3e5
SHA2563e6a9a608eae962fb3292a14b94abee67748f231c3db5db2eba104d5cc380e97
SHA5125d336175a864ef621f53cb713d574ac666c93ac1cc264d51bcf8318007742106cb2a0a010023fd243c8a455976ed433429fcf18a3151fd667f107d8d301c4a7d
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\ChromeRecovery.exeMD5
4f68f78a0266c5d78a15b2c4da3c49e2
SHA1caf0c6817fd09118209425d0a1661952292ea825
SHA256e0f4d7e3939abac66e93004b7f1a3fb6b4932157809f32e13fa0cca55ef4e3bb
SHA512370327442f7ee6f2adbe6c9097a1cb18fc0393a7f8b60568420d020676f42635b52a50dad4835e54efa322b410a40de938ad49e0308c54e44a89a6e20cdb8b58
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\GoogleUpdateSetup.exeMD5
2bdcb73f0ae6fe96e7e8e4e6a9cd88f8
SHA1fc48760b9cf0a4c1fbe83457d3116064462f0a6a
SHA256bb93117d3a88cb59f1fe152309746d673e5597d0fce71b14f41493c54f451eb3
SHA512f7a1d983d3dac79b2c1949222c65283e246bde0cae52f09c6c7f092e9e78a8201710c13eaf771b735cce70e8c5a64a43b99c678543ef62372100da83f02d1d46
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3388_1412002591\GoogleUpdateSetup.exeMD5
2bdcb73f0ae6fe96e7e8e4e6a9cd88f8
SHA1fc48760b9cf0a4c1fbe83457d3116064462f0a6a
SHA256bb93117d3a88cb59f1fe152309746d673e5597d0fce71b14f41493c54f451eb3
SHA512f7a1d983d3dac79b2c1949222c65283e246bde0cae52f09c6c7f092e9e78a8201710c13eaf771b735cce70e8c5a64a43b99c678543ef62372100da83f02d1d46
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.111\Recovery.crx3MD5
7ebbe06233c74d47bdb914d8afa24308
SHA1de79a98572a9599fbfbae8ce2ebe12d9b434f20d
SHA25636a56323ca678c7070637c765fbe1c52eaccc8234afe126a9160246e1542e7a9
SHA512a61bf368b6ce4fc33eaefbbece39e626befb7f06d10f846cfa4e0135a401b58ed8e8d0755195d4932a036d3fc110e2112e1a6a87e1ba84879314cf9580382d2b
-
\??\pipe\crashpad_1952_TFAXPDQANLONGEKRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_3060_BBLZCJDGEAIOXZJWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files (x86)\Google\Temp\GUM9BCA.tmp\goopdate.dllMD5
ff8eafc8c23ccbb8cf755f189fa6fdc3
SHA12e7e358d717dc9d190659b2f131c156c9327ab25
SHA25658ea125a6d6a7bbd68fb8d2332618a7218bd5893e9e91b5f60d3ad422cd5c4bc
SHA5124dc7e50aacf7c08a30380a7a7d64fdbaf6d015cae7495f293f0a97daec270512f83695936a095ae8161c3a120221d8d61ae49e04866dd41935c49e4b81052d04
-
memory/156-290-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/156-285-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/156-284-0x0000000000414F3A-mapping.dmp
-
memory/156-283-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/208-229-0x0000000000000000-mapping.dmp
-
memory/416-188-0x0000000000000000-mapping.dmp
-
memory/668-267-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/668-265-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/668-264-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/668-258-0x0000000000000000-mapping.dmp
-
memory/804-257-0x00000000000D0000-0x000000000017E000-memory.dmpFilesize
696KB
-
memory/804-243-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/804-242-0x0000000000000000-mapping.dmp
-
memory/804-244-0x0000000001930000-0x0000000001931000-memory.dmpFilesize
4KB
-
memory/804-245-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/1036-183-0x0000000000000000-mapping.dmp
-
memory/1376-304-0x0000000000000000-mapping.dmp
-
memory/1376-237-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1476-192-0x0000000000000000-mapping.dmp
-
memory/1744-228-0x0000000000000000-mapping.dmp
-
memory/1756-146-0x0000000000000000-mapping.dmp
-
memory/1776-235-0x0000000000000000-mapping.dmp
-
memory/1776-238-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/1864-280-0x0000000000000000-mapping.dmp
-
memory/1872-194-0x0000000000000000-mapping.dmp
-
memory/2176-185-0x0000000000000000-mapping.dmp
-
memory/2184-224-0x0000000000000000-mapping.dmp
-
memory/2184-226-0x0000000002C80000-0x0000000002C81000-memory.dmpFilesize
4KB
-
memory/2184-225-0x0000000002C80000-0x0000000002C81000-memory.dmpFilesize
4KB
-
memory/2240-219-0x0000000000000000-mapping.dmp
-
memory/2240-221-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/2240-222-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/2452-151-0x0000000000000000-mapping.dmp
-
memory/2504-187-0x0000000000000000-mapping.dmp
-
memory/2840-273-0x0000000000000000-mapping.dmp
-
memory/2872-147-0x0000000000000000-mapping.dmp
-
memory/2924-186-0x0000000000000000-mapping.dmp
-
memory/3060-118-0x0000000000000000-mapping.dmp
-
memory/3060-120-0x00000176FB7B0000-0x00000176FB7B2000-memory.dmpFilesize
8KB
-
memory/3060-119-0x00000176FB7B0000-0x00000176FB7B2000-memory.dmpFilesize
8KB
-
memory/3116-193-0x0000000000000000-mapping.dmp
-
memory/3140-206-0x0000000000000000-mapping.dmp
-
memory/3140-207-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/3140-208-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/3252-239-0x0000000000000000-mapping.dmp
-
memory/3252-241-0x0000000004440000-0x0000000004441000-memory.dmpFilesize
4KB
-
memory/3388-125-0x000002372CDC0000-0x000002372CDC2000-memory.dmpFilesize
8KB
-
memory/3388-126-0x000002372CDC0000-0x000002372CDC2000-memory.dmpFilesize
8KB
-
memory/3388-227-0x0000000000000000-mapping.dmp
-
memory/3504-395-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/3536-128-0x0000000000000000-mapping.dmp
-
memory/3576-149-0x0000000000000000-mapping.dmp
-
memory/3792-152-0x0000000000000000-mapping.dmp
-
memory/3876-251-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/3876-205-0x0000000000000000-mapping.dmp
-
memory/3876-236-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3876-253-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/3876-262-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/3876-261-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/3876-260-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/3876-252-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3876-254-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/3876-250-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3876-247-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/3876-259-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/3876-248-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/3876-249-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/3876-256-0x0000000000400000-0x00000000009A4000-memory.dmpFilesize
5.6MB
-
memory/3876-255-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/3932-121-0x0000000000000000-mapping.dmp
-
memory/3932-123-0x000001D618690000-0x000001D618692000-memory.dmpFilesize
8KB
-
memory/3932-122-0x000001D618690000-0x000001D618692000-memory.dmpFilesize
8KB
-
memory/4068-200-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4068-195-0x0000000000000000-mapping.dmp
-
memory/4068-116-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/4068-115-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/4108-148-0x0000000000000000-mapping.dmp
-
memory/4120-189-0x0000000000000000-mapping.dmp
-
memory/4168-282-0x0000000000000000-mapping.dmp
-
memory/4196-184-0x0000000000000000-mapping.dmp
-
memory/4256-303-0x00000000056A0000-0x0000000005CA6000-memory.dmpFilesize
6.0MB
-
memory/4256-294-0x000000000041852A-mapping.dmp
-
memory/4336-133-0x0000000000000000-mapping.dmp
-
memory/4340-272-0x00000000017E0000-0x000000000192A000-memory.dmpFilesize
1.3MB
-
memory/4340-275-0x0000000034390000-0x00000000344E8000-memory.dmpFilesize
1.3MB
-
memory/4340-278-0x00000000344F0000-0x0000000034548000-memory.dmpFilesize
352KB
-
memory/4340-274-0x0000000033A00000-0x0000000033BC6000-memory.dmpFilesize
1.8MB
-
memory/4340-270-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/4340-269-0x0000000001830000-0x0000000001831000-memory.dmpFilesize
4KB
-
memory/4340-268-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/4356-130-0x0000000000000000-mapping.dmp
-
memory/4388-150-0x0000000000000000-mapping.dmp
-
memory/4404-190-0x0000000000000000-mapping.dmp
-
memory/4420-191-0x0000000000000000-mapping.dmp
-
memory/4504-168-0x00000000006B0000-0x00000000007FA000-memory.dmpFilesize
1.3MB
-
memory/4504-161-0x0000000000000000-mapping.dmp
-
memory/4620-214-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-213-0x0000000002FE0000-0x0000000002FE1000-memory.dmpFilesize
4KB
-
memory/4620-199-0x0000000000000000-mapping.dmp
-
memory/4620-201-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/4620-223-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/4620-218-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-220-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-217-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-216-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-215-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-212-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-202-0x0000000002AD0000-0x0000000002DB0000-memory.dmpFilesize
2.9MB
-
memory/4620-211-0x0000000004DA0000-0x0000000004DA4000-memory.dmpFilesize
16KB
-
memory/4620-210-0x0000000004D80000-0x0000000004D95000-memory.dmpFilesize
84KB
-
memory/4620-209-0x0000000004AD0000-0x0000000004ADF000-memory.dmpFilesize
60KB
-
memory/4636-305-0x0000000000000000-mapping.dmp
-
memory/4636-394-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4764-166-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4780-165-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4788-171-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4804-169-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4808-277-0x0000000000000000-mapping.dmp
-
memory/4808-231-0x0000000000000000-mapping.dmp
-
memory/4820-281-0x0000000000000000-mapping.dmp
-
memory/4820-291-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/4820-286-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/4832-230-0x0000000000000000-mapping.dmp
-
memory/4848-170-0x0000000000620000-0x000000000076A000-memory.dmpFilesize
1.3MB
-
memory/4848-164-0x0000000000000000-mapping.dmp
-
memory/4904-163-0x0000000000000000-mapping.dmp
-
memory/4904-172-0x00000000005F0000-0x000000000073A000-memory.dmpFilesize
1.3MB
-
memory/4928-182-0x0000000004600000-0x0000000004601000-memory.dmpFilesize
4KB
-
memory/4928-177-0x0000000000000000-mapping.dmp
-
memory/4940-167-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/4940-162-0x0000000000000000-mapping.dmp
-
memory/4976-232-0x0000000000000000-mapping.dmp
-
memory/5020-181-0x0000000004580000-0x0000000004581000-memory.dmpFilesize
4KB
-
memory/5020-173-0x0000000000000000-mapping.dmp
-
memory/5020-175-0x0000000000400000-0x0000000001860000-memory.dmpFilesize
20.4MB
-
memory/5028-197-0x0000000000000000-mapping.dmp
-
memory/5044-180-0x0000000001DD0000-0x0000000001DD1000-memory.dmpFilesize
4KB
-
memory/5044-179-0x0000000000400000-0x0000000001860000-memory.dmpFilesize
20.4MB
-
memory/5044-174-0x0000000000000000-mapping.dmp
-
memory/5060-204-0x000002034EDA0000-0x000002034EDA2000-memory.dmpFilesize
8KB
-
memory/5060-203-0x000002034EDA0000-0x000002034EDA2000-memory.dmpFilesize
8KB
-
memory/5132-306-0x0000000000000000-mapping.dmp
-
memory/5192-307-0x0000000000000000-mapping.dmp
-
memory/5236-397-0x0000000004300000-0x0000000004301000-memory.dmpFilesize
4KB
-
memory/5588-313-0x0000000000000000-mapping.dmp
-
memory/5672-314-0x0000000000000000-mapping.dmp
-
memory/5708-317-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/5744-318-0x0000000000000000-mapping.dmp
-
memory/5744-319-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/5796-320-0x0000000000000000-mapping.dmp
-
memory/5796-322-0x0000000000400000-0x0000000001860000-memory.dmpFilesize
20.4MB
-
memory/5796-323-0x0000000004300000-0x0000000004301000-memory.dmpFilesize
4KB
-
memory/5900-330-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/5924-331-0x0000000002090000-0x0000000002091000-memory.dmpFilesize
4KB
-
memory/5924-329-0x0000000000000000-mapping.dmp
-
memory/5952-333-0x0000000004300000-0x0000000004301000-memory.dmpFilesize
4KB
-
memory/6120-344-0x0000000001330000-0x0000000001331000-memory.dmpFilesize
4KB
-
memory/6120-345-0x0000000001332000-0x0000000001333000-memory.dmpFilesize
4KB
-
memory/6120-362-0x0000000001333000-0x0000000001334000-memory.dmpFilesize
4KB
-
memory/6120-363-0x0000000001334000-0x0000000001336000-memory.dmpFilesize
8KB