Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-10-2021 00:31
Static task
static1
Behavioral task
behavioral1
Sample
ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe
Resource
win7-en-20210920
General
-
Target
ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe
-
Size
389KB
-
MD5
19b0bf2bb132231de9dd08f8761c5998
-
SHA1
a08a73f6fa211061d6defc14bc8fec6ada2166c4
-
SHA256
ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
-
SHA512
5bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
Malware Config
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 4912 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3464 4912 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7952 4912 rundll32.exe -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Pictures\Adobe Films\X6eG4Z2uJmedRHb9Dnal4fff.exe family_socelars C:\Users\Admin\Pictures\Adobe Films\X6eG4Z2uJmedRHb9Dnal4fff.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 3536 created 1512 3536 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe PID 4428 created 2220 4428 WerFault.exe GcleanerEU.exe PID 6900 created 5448 6900 WerFault.exe gcleaner.exe -
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE ClipBanker Variant Activity (POST)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Blocklisted process makes network request 5 IoCs
Processes:
MsiExec.execmd.exeflow pid process 288 5728 MsiExec.exe 336 5728 MsiExec.exe 338 5728 MsiExec.exe 366 6840 cmd.exe 368 6840 cmd.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
DYbALA.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe -
Executes dropped EXE 64 IoCs
Processes:
9fOhvnhvsaw2HRQXop26b8Xm.exeOdF7_xtirfO7cc3XPYf5GcAi.exehOnADgqE5fQBsL6tFdZeagZ4.exePh_AwRuELXigvWylgPeTujFx.exeX6eG4Z2uJmedRHb9Dnal4fff.exeeTrOr8TGRq9B0nMudMF11VDJ.exet0uwGfRwNd4zNGKD5cqWEQN9.exeK8v1i_NH2WAmPlPWJhEYncrO.exe6107403.exeWerFault.exeWiwZ8i_vFloMueNbDjtBxJbY.exeWap3rAoRjyaZsYVRD9RNqtXX.exeWiwZ8i_vFloMueNbDjtBxJbY.tmp6205814.exekPBhgOaGQk.exeDYbALA.exe6617674.exe6774750.exe6118167.exeWinHoster.exesetup.exefoldershare.exeZHerobishyku.exeHaqunatune.exesetting.exeGcleanerEU.exeinstaller.exeany.exeuiso9_pe.exeuiso9_pe.tmpcustomer51.exeuiso9_pe.exeuiso9_pe.tmpgcleaner.exeFastPC.exeCalculator.exeFastPC.exe6205814.exeFastPC.tmpautosubplayer.exe6617674.exeinstaller.exeCalculator.exeMsiExec.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeFaster.exeFast_.exeFast.exe13.exeCalculator.exeCalculator.exeinstallersetup.exeinstallersetup1.execustomer5.exejg3_3uag.exeany.exeuiso9_pe.exeinstallersetup.tmpuiso9_pe.tmpinstallersetup1.tmppid process 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 1512 hOnADgqE5fQBsL6tFdZeagZ4.exe 1776 Ph_AwRuELXigvWylgPeTujFx.exe 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe 2388 eTrOr8TGRq9B0nMudMF11VDJ.exe 3800 t0uwGfRwNd4zNGKD5cqWEQN9.exe 4176 K8v1i_NH2WAmPlPWJhEYncrO.exe 5016 6107403.exe 1252 WerFault.exe 1452 WiwZ8i_vFloMueNbDjtBxJbY.exe 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 1420 WiwZ8i_vFloMueNbDjtBxJbY.tmp 1480 6205814.exe 2116 kPBhgOaGQk.exe 3620 DYbALA.exe 4480 6617674.exe 4612 6774750.exe 1572 6118167.exe 2032 WinHoster.exe 944 setup.exe 3212 foldershare.exe 948 ZHerobishyku.exe 2344 Haqunatune.exe 1772 setting.exe 2220 GcleanerEU.exe 2156 installer.exe 2964 any.exe 4472 uiso9_pe.exe 4264 uiso9_pe.tmp 5236 customer51.exe 5256 uiso9_pe.exe 5376 uiso9_pe.tmp 5448 gcleaner.exe 5608 FastPC.exe 5828 Calculator.exe 5996 FastPC.exe 6060 6205814.exe 6084 FastPC.tmp 2640 autosubplayer.exe 4292 6617674.exe 4236 installer.exe 8 Calculator.exe 5728 MsiExec.exe 760 Calculator.exe 4972 Calculator.exe 1596 Calculator.exe 6240 Calculator.exe 6276 Calculator.exe 6304 Faster.exe 6472 Fast_.exe 6572 Fast.exe 6644 13.exe 6956 Calculator.exe 6952 Calculator.exe 5972 installersetup.exe 6732 installersetup1.exe 6740 customer5.exe 7024 jg3_3uag.exe 7032 any.exe 6288 uiso9_pe.exe 5476 installersetup.tmp 5816 uiso9_pe.tmp 4600 installersetup1.tmp -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9fOhvnhvsaw2HRQXop26b8Xm.exeZHerobishyku.exeCalculator.exeCalculator.exeCalculator.exeFaster.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation 9fOhvnhvsaw2HRQXop26b8Xm.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation ZHerobishyku.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Faster.exe -
Loads dropped DLL 64 IoCs
Processes:
Wap3rAoRjyaZsYVRD9RNqtXX.exeWiwZ8i_vFloMueNbDjtBxJbY.tmprundll32.exesetup.exemsiexec.exesetting.exeinstaller.exeuiso9_pe.tmpuiso9_pe.tmpCalculator.exeMsiExec.exeMsiExec.exeFastPC.tmpautosubplayer.exerundll32.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeFastPC.exeCalculator.exeFast.exeMsiExec.exepid process 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 1420 WiwZ8i_vFloMueNbDjtBxJbY.tmp 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 1588 rundll32.exe 944 setup.exe 944 setup.exe 4700 msiexec.exe 4700 msiexec.exe 1772 setting.exe 2156 installer.exe 2156 installer.exe 4264 uiso9_pe.tmp 5376 uiso9_pe.tmp 2156 installer.exe 944 setup.exe 944 setup.exe 5828 Calculator.exe 944 setup.exe 5776 MsiExec.exe 5776 MsiExec.exe 5956 MsiExec.exe 5828 Calculator.exe 5828 Calculator.exe 5956 MsiExec.exe 6084 FastPC.tmp 6084 FastPC.tmp 2640 autosubplayer.exe 4304 rundll32.exe 944 setup.exe 1368 Wap3rAoRjyaZsYVRD9RNqtXX.exe 8 Calculator.exe 760 Calculator.exe 4972 Calculator.exe 760 Calculator.exe 760 Calculator.exe 4972 Calculator.exe 4972 Calculator.exe 1596 Calculator.exe 1596 Calculator.exe 1596 Calculator.exe 6240 Calculator.exe 6240 Calculator.exe 6240 Calculator.exe 6240 Calculator.exe 6276 Calculator.exe 6276 Calculator.exe 6276 Calculator.exe 6276 Calculator.exe 2640 autosubplayer.exe 760 Calculator.exe 760 Calculator.exe 5608 FastPC.exe 5608 FastPC.exe 6956 Calculator.exe 6956 Calculator.exe 6956 Calculator.exe 6956 Calculator.exe 6956 Calculator.exe 6572 Fast.exe 6572 Fast.exe 5728 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
setup.exe6774750.exeDYbALA.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --loGQqfG2tg" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6774750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows NT\\SHishotanimae.exe\"" DYbALA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exeinstaller.exesvchost.exemsiexec.exesetting.exedescription ioc process File opened (read-only) \??\B: installer.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: setting.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: setting.exe File opened (read-only) \??\W: setting.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: setting.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: setting.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\G: setting.exe File opened (read-only) \??\O: setting.exe File opened (read-only) \??\Y: setting.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: setting.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\E: setting.exe File opened (read-only) \??\M: setting.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\N: setting.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\K: setting.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\U: setting.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: setting.exe File opened (read-only) \??\Z: setting.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ipinfo.io 13 ipinfo.io 81 ip-api.com 236 ipinfo.io 266 wtfismyip.com 38 ipinfo.io 155 ip-api.com 234 ipinfo.io 265 wtfismyip.com -
Drops file in System32 directory 9 IoCs
Processes:
svchost.exesvchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 1CFCD6827D2142C7 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
svchost.exe6205814.exe6617674.exedescription pid process target process PID 4764 set thread context of 4148 4764 svchost.exe svchost.exe PID 1480 set thread context of 6060 1480 6205814.exe 6205814.exe PID 4480 set thread context of 4292 4480 6617674.exe 6617674.exe PID 4764 set thread context of 7840 4764 svchost.exe svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
autosubplayer.exeuiso9_pe.tmpdescription ioc process File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\03_lastfm.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libfile_keystore_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemuxdump_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpgv_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvoc_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\UltraISO\lang\is-8U0CE.tmp uiso9_pe.tmp File created C:\Program Files (x86)\lighteningplayer\libvlc.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\regstr autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawvid_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libfile_logger_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_ps_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\UltraISO\backup uiso9_pe.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\dumpmeta.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libhttp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libcaf_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libps_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_concat_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Back-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libfreetype_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\UltraISO\lang\is-O0L0Q.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-CFSVG.tmp uiso9_pe.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\create_stream.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\gui\libqt_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\UltraISO\is-4K1US.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\is-U1I2O.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-2MH09.tmp uiso9_pe.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist_jstree.xml autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libdirectsound_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libwav_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libxa_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\UltraISO\drivers\is-S65OA.tmp uiso9_pe.tmp File created C:\Program Files (x86)\UltraISO\lang\is-ORUJ4.tmp uiso9_pe.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsc_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsvorepository_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\UltraISO\lang\is-KAKJ5.tmp uiso9_pe.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libadummy_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll autosubplayer.exe -
Drops file in Windows directory 26 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exemsiexec.exeLogonUI.exeinstallersetup1.tmpinstallersetup.tmpMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI2623.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3019.tmp msiexec.exe File created C:\Windows\rescache\_merged\421858948\382050043.pri LogonUI.exe File opened for modification C:\Windows\rssllxyn\Runtimebroker6.exe installersetup1.tmp File opened for modification C:\Windows\Installer\MSI2903.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\rssllxyn\is-2DR3D.tmp installersetup1.tmp File created C:\Windows\rssllxyn\is-ALPKQ.tmp installersetup.tmp File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f76d453.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1B53.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1EEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2818.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3710.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\f76d453.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI287.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1351.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1537.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1855.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\rssllxyn\Runtimebroker5.exe installersetup.tmp -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5116 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 3332 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 2364 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 3532 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 948 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 1252 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 2804 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 2452 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 3264 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 3536 1512 WerFault.exe hOnADgqE5fQBsL6tFdZeagZ4.exe 5028 2220 WerFault.exe GcleanerEU.exe 2980 2220 WerFault.exe GcleanerEU.exe 4268 2220 WerFault.exe GcleanerEU.exe 4672 2220 WerFault.exe GcleanerEU.exe 5328 2220 WerFault.exe GcleanerEU.exe 5584 5448 WerFault.exe gcleaner.exe 5760 5448 WerFault.exe gcleaner.exe 4276 5448 WerFault.exe gcleaner.exe 2988 2220 WerFault.exe GcleanerEU.exe 2944 5448 WerFault.exe gcleaner.exe 6104 2220 WerFault.exe GcleanerEU.exe 3064 2220 WerFault.exe GcleanerEU.exe 5356 5448 WerFault.exe gcleaner.exe 4428 2220 WerFault.exe GcleanerEU.exe 6556 5448 WerFault.exe gcleaner.exe 6924 5448 WerFault.exe gcleaner.exe 6636 5448 WerFault.exe gcleaner.exe 6900 5448 WerFault.exe gcleaner.exe -
NSIS installer 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exe nsis_installer_1 C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exe nsis_installer_2 C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exe nsis_installer_1 C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\Calculator\setup.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\Calculator\setup.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\Calculator\setup.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\Calculator\setup.exe nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
eTrOr8TGRq9B0nMudMF11VDJ.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eTrOr8TGRq9B0nMudMF11VDJ.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eTrOr8TGRq9B0nMudMF11VDJ.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eTrOr8TGRq9B0nMudMF11VDJ.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FastPC.exeFast.exesvchost.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FastPC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FastPC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Fast.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Fast.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4564 schtasks.exe 4616 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 7900 timeout.exe 5844 timeout.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4012 taskkill.exe 4452 taskkill.exe 1724 taskkill.exe 3052 taskkill.exe -
Processes:
installersetup1.tmpinstallersetup.tmpMicrosoftEdge.exeMicrosoftEdgeCP.exebrowser_broker.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0018.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0019.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0010.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_006.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_008.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0012.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0019.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0015.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0017.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Support_Chat_001.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_007.exe = "11000" installersetup.tmp Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Support Chat.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0013.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_009.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0020.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_004.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_003.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_008.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0011.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0016.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0016.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0017.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0018.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0020.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_004.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_005.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_001.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0011.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0013.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0014.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0015.exe = "11000" installersetup.tmp Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_002.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0012.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0014.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Support Chat.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_005.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_006.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Support_Chat_001.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_007.exe = "11000" installersetup1.tmp Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_002.exe = "11000" installersetup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_003.exe = "11000" installersetup.tmp Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_001.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_009.exe = "11000" installersetup1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Windows_Update_0010.exe = "11000" installersetup1.tmp -
Modifies data under HKEY_USERS 41 IoCs
Processes:
LogonUI.exesvchost.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeregsvr32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeuiso9_pe.tmpMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\binimage\DefaultIcon\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\",0" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099} regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000313ffbc731e590222bafe4c42a1d9b7d416f9212f5a4ccfbe67f6d570a7b8c8f98e55a13fa91dd9bd5c83bbd7d4035307ea758365d8a08333c7a MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 237d5eab6ec8d701 MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UltraISO regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "UltraISO" uiso9_pe.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\DefaultIcon uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\0\win64\ = "C:\\Program Files (x86)\\UltraISO\\isoshl64.dll" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "hc95srk" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISOShell.UIContextMenu\CurVer\ = "ISOShell.UIContextMenu.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ui\ = "UltraISO" uiso9_pe.tmp Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = eda47e9320aed701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\ = "IUIContextMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltraISO regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open\command\ = "\"C:\\Program Files (x86)\\UltraISO\\UltraISO.exe\" \"%1\"" uiso9_pe.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UltraISO\ = "{AD392E40-428C-459F-961E-9B147782D099}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD392E40-428C-459F-961E-9B147782D099}\ = "UIContextMenu Class" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UltraISO\shell\open uiso9_pe.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1CD46142-F3D3-4E46-87BA-7CC019142F9D}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{91BCF767-27D5-4993-AB0B-9DBF2524B203}" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9653DE66-C5E0-4AEE-ADE5-0197BA68CE2B} regsvr32.exe -
Processes:
6205814.exeX6eG4Z2uJmedRHb9Dnal4fff.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 6205814.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 6205814.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 X6eG4Z2uJmedRHb9Dnal4fff.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e X6eG4Z2uJmedRHb9Dnal4fff.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C 6205814.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 6205814.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 6205814.exe -
Script User-Agent 11 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 272 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 351 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 352 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 213 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 235 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 251 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 256 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 315 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 90 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 236 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 242 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9fOhvnhvsaw2HRQXop26b8Xm.exeOdF7_xtirfO7cc3XPYf5GcAi.exepid process 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe 3788 OdF7_xtirfO7cc3XPYf5GcAi.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
foldershare.exepid process 3040 3212 foldershare.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 620 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
eTrOr8TGRq9B0nMudMF11VDJ.exeMicrosoftEdgeCP.execmd.exepid process 2388 eTrOr8TGRq9B0nMudMF11VDJ.exe 768 MicrosoftEdgeCP.exe 768 MicrosoftEdgeCP.exe 768 MicrosoftEdgeCP.exe 768 MicrosoftEdgeCP.exe 6840 cmd.exe 6840 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
X6eG4Z2uJmedRHb9Dnal4fff.exePh_AwRuELXigvWylgPeTujFx.exeWerFault.exetaskkill.exeWerFault.exeWerFault.exeWerFault.exe6107403.exeWerFault.exetaskkill.exe6205814.exerundll32.exesvchost.exe6617674.exedescription pid process Token: SeCreateTokenPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeAssignPrimaryTokenPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeLockMemoryPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeIncreaseQuotaPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeMachineAccountPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeTcbPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeSecurityPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeTakeOwnershipPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeLoadDriverPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeSystemProfilePrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeSystemtimePrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeProfSingleProcessPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeIncBasePriorityPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeCreatePagefilePrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeCreatePermanentPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeBackupPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeRestorePrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeShutdownPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeDebugPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeAuditPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeSystemEnvironmentPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeChangeNotifyPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeRemoteShutdownPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeUndockPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeSyncAgentPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeEnableDelegationPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeManageVolumePrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeImpersonatePrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeCreateGlobalPrivilege 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: 31 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: 32 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: 33 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: 34 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: 35 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe Token: SeDebugPrivilege 1776 Ph_AwRuELXigvWylgPeTujFx.exe Token: SeRestorePrivilege 5116 WerFault.exe Token: SeBackupPrivilege 5116 WerFault.exe Token: SeDebugPrivilege 5116 WerFault.exe Token: SeDebugPrivilege 4452 taskkill.exe Token: SeDebugPrivilege 3332 WerFault.exe Token: SeDebugPrivilege 2364 WerFault.exe Token: SeDebugPrivilege 3532 WerFault.exe Token: SeDebugPrivilege 5016 6107403.exe Token: SeDebugPrivilege 948 WerFault.exe Token: SeDebugPrivilege 1724 taskkill.exe Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeDebugPrivilege 1480 6205814.exe Token: SeDebugPrivilege 1588 rundll32.exe Token: SeDebugPrivilege 1588 rundll32.exe Token: SeDebugPrivilege 4764 svchost.exe Token: SeDebugPrivilege 4480 6617674.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
setting.exeinstaller.exeFastPC.tmpCalculator.exeuiso9_pe.tmpuiso9_pe.tmpinstaller.exeinstallersetup1.tmpinstallersetup.tmppid process 1772 setting.exe 2156 installer.exe 6084 FastPC.tmp 3040 3040 5828 Calculator.exe 3040 3040 5376 uiso9_pe.tmp 5816 uiso9_pe.tmp 6204 installer.exe 4600 installersetup1.tmp 5476 installersetup.tmp -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
pid process 3040 3040 3040 -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeLogonUI.exepid process 3040 1864 MicrosoftEdge.exe 768 MicrosoftEdgeCP.exe 768 MicrosoftEdgeCP.exe 7196 LogonUI.exe 7196 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe9fOhvnhvsaw2HRQXop26b8Xm.exePh_AwRuELXigvWylgPeTujFx.exeX6eG4Z2uJmedRHb9Dnal4fff.execmd.exeWerFault.exeWiwZ8i_vFloMueNbDjtBxJbY.exemshta.execmd.exekPBhgOaGQk.exedescription pid process target process PID 2756 wrote to memory of 4508 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe 9fOhvnhvsaw2HRQXop26b8Xm.exe PID 2756 wrote to memory of 4508 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe 9fOhvnhvsaw2HRQXop26b8Xm.exe PID 2756 wrote to memory of 4508 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe 9fOhvnhvsaw2HRQXop26b8Xm.exe PID 2756 wrote to memory of 4564 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe schtasks.exe PID 2756 wrote to memory of 4564 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe schtasks.exe PID 2756 wrote to memory of 4564 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe schtasks.exe PID 2756 wrote to memory of 4616 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe schtasks.exe PID 2756 wrote to memory of 4616 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe schtasks.exe PID 2756 wrote to memory of 4616 2756 ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe schtasks.exe PID 4508 wrote to memory of 3788 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe OdF7_xtirfO7cc3XPYf5GcAi.exe PID 4508 wrote to memory of 3788 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe OdF7_xtirfO7cc3XPYf5GcAi.exe PID 4508 wrote to memory of 1512 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe hOnADgqE5fQBsL6tFdZeagZ4.exe PID 4508 wrote to memory of 1512 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe hOnADgqE5fQBsL6tFdZeagZ4.exe PID 4508 wrote to memory of 1512 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe hOnADgqE5fQBsL6tFdZeagZ4.exe PID 4508 wrote to memory of 1776 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe Ph_AwRuELXigvWylgPeTujFx.exe PID 4508 wrote to memory of 1776 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe Ph_AwRuELXigvWylgPeTujFx.exe PID 4508 wrote to memory of 1328 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe X6eG4Z2uJmedRHb9Dnal4fff.exe PID 4508 wrote to memory of 1328 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe X6eG4Z2uJmedRHb9Dnal4fff.exe PID 4508 wrote to memory of 1328 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe X6eG4Z2uJmedRHb9Dnal4fff.exe PID 4508 wrote to memory of 2388 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe eTrOr8TGRq9B0nMudMF11VDJ.exe PID 4508 wrote to memory of 2388 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe eTrOr8TGRq9B0nMudMF11VDJ.exe PID 4508 wrote to memory of 2388 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe eTrOr8TGRq9B0nMudMF11VDJ.exe PID 4508 wrote to memory of 3800 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe t0uwGfRwNd4zNGKD5cqWEQN9.exe PID 4508 wrote to memory of 3800 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe t0uwGfRwNd4zNGKD5cqWEQN9.exe PID 4508 wrote to memory of 4176 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe K8v1i_NH2WAmPlPWJhEYncrO.exe PID 4508 wrote to memory of 4176 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe K8v1i_NH2WAmPlPWJhEYncrO.exe PID 4508 wrote to memory of 4176 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe K8v1i_NH2WAmPlPWJhEYncrO.exe PID 1776 wrote to memory of 5016 1776 Ph_AwRuELXigvWylgPeTujFx.exe 6107403.exe PID 1776 wrote to memory of 5016 1776 Ph_AwRuELXigvWylgPeTujFx.exe 6107403.exe PID 1776 wrote to memory of 5016 1776 Ph_AwRuELXigvWylgPeTujFx.exe 6107403.exe PID 1328 wrote to memory of 5012 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe cmd.exe PID 1328 wrote to memory of 5012 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe cmd.exe PID 1328 wrote to memory of 5012 1328 X6eG4Z2uJmedRHb9Dnal4fff.exe cmd.exe PID 5012 wrote to memory of 4452 5012 cmd.exe taskkill.exe PID 5012 wrote to memory of 4452 5012 cmd.exe taskkill.exe PID 5012 wrote to memory of 4452 5012 cmd.exe taskkill.exe PID 4508 wrote to memory of 1252 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe WerFault.exe PID 4508 wrote to memory of 1252 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe WerFault.exe PID 4508 wrote to memory of 1252 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe WerFault.exe PID 1252 wrote to memory of 3344 1252 WerFault.exe mshta.exe PID 1252 wrote to memory of 3344 1252 WerFault.exe mshta.exe PID 1252 wrote to memory of 3344 1252 WerFault.exe mshta.exe PID 4508 wrote to memory of 1452 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe WiwZ8i_vFloMueNbDjtBxJbY.exe PID 4508 wrote to memory of 1452 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe WiwZ8i_vFloMueNbDjtBxJbY.exe PID 4508 wrote to memory of 1452 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe WiwZ8i_vFloMueNbDjtBxJbY.exe PID 4508 wrote to memory of 1368 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe Wap3rAoRjyaZsYVRD9RNqtXX.exe PID 4508 wrote to memory of 1368 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe Wap3rAoRjyaZsYVRD9RNqtXX.exe PID 4508 wrote to memory of 1368 4508 9fOhvnhvsaw2HRQXop26b8Xm.exe Wap3rAoRjyaZsYVRD9RNqtXX.exe PID 1452 wrote to memory of 1420 1452 WiwZ8i_vFloMueNbDjtBxJbY.exe WiwZ8i_vFloMueNbDjtBxJbY.tmp PID 1452 wrote to memory of 1420 1452 WiwZ8i_vFloMueNbDjtBxJbY.exe WiwZ8i_vFloMueNbDjtBxJbY.tmp PID 1452 wrote to memory of 1420 1452 WiwZ8i_vFloMueNbDjtBxJbY.exe WiwZ8i_vFloMueNbDjtBxJbY.tmp PID 1776 wrote to memory of 1480 1776 Ph_AwRuELXigvWylgPeTujFx.exe 6205814.exe PID 1776 wrote to memory of 1480 1776 Ph_AwRuELXigvWylgPeTujFx.exe 6205814.exe PID 1776 wrote to memory of 1480 1776 Ph_AwRuELXigvWylgPeTujFx.exe 6205814.exe PID 3344 wrote to memory of 3584 3344 mshta.exe cmd.exe PID 3344 wrote to memory of 3584 3344 mshta.exe cmd.exe PID 3344 wrote to memory of 3584 3344 mshta.exe cmd.exe PID 3584 wrote to memory of 2116 3584 cmd.exe kPBhgOaGQk.exe PID 3584 wrote to memory of 2116 3584 cmd.exe kPBhgOaGQk.exe PID 3584 wrote to memory of 2116 3584 cmd.exe kPBhgOaGQk.exe PID 3584 wrote to memory of 1724 3584 cmd.exe taskkill.exe PID 3584 wrote to memory of 1724 3584 cmd.exe taskkill.exe PID 3584 wrote to memory of 1724 3584 cmd.exe taskkill.exe PID 2116 wrote to memory of 2836 2116 kPBhgOaGQk.exe mshta.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Enumerates connected drives
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe"C:\Users\Admin\AppData\Local\Temp\ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\9fOhvnhvsaw2HRQXop26b8Xm.exe"C:\Users\Admin\Documents\9fOhvnhvsaw2HRQXop26b8Xm.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\OdF7_xtirfO7cc3XPYf5GcAi.exe"C:\Users\Admin\Pictures\Adobe Films\OdF7_xtirfO7cc3XPYf5GcAi.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\hOnADgqE5fQBsL6tFdZeagZ4.exe"C:\Users\Admin\Pictures\Adobe Films\hOnADgqE5fQBsL6tFdZeagZ4.exe" /mixtwo3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 6484⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 6804⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 6844⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 8004⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 9044⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 8644⤵
- Executes dropped EXE
- Program crash
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 11764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 12444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 13284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 13204⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\Ph_AwRuELXigvWylgPeTujFx.exe"C:\Users\Admin\Pictures\Adobe Films\Ph_AwRuELXigvWylgPeTujFx.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\6107403.exe"C:\Users\Admin\AppData\Roaming\6107403.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6205814.exe"C:\Users\Admin\AppData\Roaming\6205814.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6205814.exe"C:\Users\Admin\AppData\Roaming\6205814.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6617674.exe"C:\Users\Admin\AppData\Roaming\6617674.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6617674.exe"C:\Users\Admin\AppData\Roaming\6617674.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6774750.exe"C:\Users\Admin\AppData\Roaming\6774750.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6118167.exe"C:\Users\Admin\AppData\Roaming\6118167.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\X6eG4Z2uJmedRHb9Dnal4fff.exe"C:\Users\Admin\Pictures\Adobe Films\X6eG4Z2uJmedRHb9Dnal4fff.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\eTrOr8TGRq9B0nMudMF11VDJ.exe"C:\Users\Admin\Pictures\Adobe Films\eTrOr8TGRq9B0nMudMF11VDJ.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\t0uwGfRwNd4zNGKD5cqWEQN9.exe"C:\Users\Admin\Pictures\Adobe Films\t0uwGfRwNd4zNGKD5cqWEQN9.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\K8v1i_NH2WAmPlPWJhEYncrO.exe"C:\Users\Admin\Pictures\Adobe Films\K8v1i_NH2WAmPlPWJhEYncrO.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exe"C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exe"3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exe" ) do taskkill -f -iM "%~NxM"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"9⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC9⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "4D571Ldj7_d5uqCzM4uzPa7R.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\WiwZ8i_vFloMueNbDjtBxJbY.exe"C:\Users\Admin\Pictures\Adobe Films\WiwZ8i_vFloMueNbDjtBxJbY.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q8E9S.tmp\WiwZ8i_vFloMueNbDjtBxJbY.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q8E9S.tmp\WiwZ8i_vFloMueNbDjtBxJbY.tmp" /SL5="$B0048,506127,422400,C:\Users\Admin\Pictures\Adobe Films\WiwZ8i_vFloMueNbDjtBxJbY.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-VH7BA.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-VH7BA.tmp\DYbALA.exe" /S /UID=27095⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\Windows Multimedia Platform\ULBMUYULST\foldershare.exe"C:\Program Files\Windows Multimedia Platform\ULBMUYULST\foldershare.exe" /VERYSILENT6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\80-bfcf8-64e-8d197-02d0dc20594a0\ZHerobishyku.exe"C:\Users\Admin\AppData\Local\Temp\80-bfcf8-64e-8d197-02d0dc20594a0\ZHerobishyku.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\fe-2e536-46a-e8689-1d88bee98226c\Haqunatune.exe"C:\Users\Admin\AppData\Local\Temp\fe-2e536-46a-e8689-1d88bee98226c\Haqunatune.exe"6⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cdk3yvgl.0ly\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\cdk3yvgl.0ly\setting.exeC:\Users\Admin\AppData\Local\Temp\cdk3yvgl.0ly\setting.exe SID=778 CID=778 SILENT=1 /quiet8⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Settings\Settings 1.0.0\install\FD7DF1F\Settings Installation.msi" SID=778 CID=778 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cdk3yvgl.0ly\setting.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cdk3yvgl.0ly\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634776122 SID=778 CID=778 SILENT=1 /quiet " SID="778" CID="778"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x2h20xm2.l5r\GcleanerEU.exe /eufive & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\x2h20xm2.l5r\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\x2h20xm2.l5r\GcleanerEU.exe /eufive8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 7649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 8009⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 8809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 9289⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 11769⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 12409⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 12249⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a13fobqp.ill\installer.exe /qn CAMPAIGN="654" & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\a13fobqp.ill\installer.exeC:\Users\Admin\AppData\Local\Temp\a13fobqp.ill\installer.exe /qn CAMPAIGN="654"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a13fobqp.ill\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a13fobqp.ill\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634776122 /qn CAMPAIGN=""654"" " CAMPAIGN="654"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h0w2mll1.xxu\any.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\h0w2mll1.xxu\any.exeC:\Users\Admin\AppData\Local\Temp\h0w2mll1.xxu\any.exe8⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exeC:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-1GT94.tmp\uiso9_pe.tmp"C:\Users\Admin\AppData\Local\Temp\is-1GT94.tmp\uiso9_pe.tmp" /SL5="$10318,2161833,831488,C:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exe"C:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exe" /VERYSILENT10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-5CI0V.tmp\uiso9_pe.tmp"C:\Users\Admin\AppData\Local\Temp\is-5CI0V.tmp\uiso9_pe.tmp" /SL5="$2033C,2161833,831488,C:\Users\Admin\AppData\Local\Temp\amdylra0.rqm\uiso9_pe.exe" /VERYSILENT11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\installersetup1.exe"C:\Users\Admin\AppData\Local\installersetup1.exe" /VERYSILENT /SUPPRESSMSGBOXES12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-3LIQG.tmp\installersetup1.tmp"C:\Users\Admin\AppData\Local\Temp\is-3LIQG.tmp\installersetup1.tmp" /SL5="$5031C,1069267,831488,C:\Users\Admin\AppData\Local\installersetup1.exe" /VERYSILENT /SUPPRESSMSGBOXES13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create Telephone101 start= auto DisplayName= "Telephone101" binPath= "C:\Windows\rssllxyn\Runtimebroker6.exe"14⤵
-
C:\Users\Admin\AppData\Local\customer5.exe"C:\Users\Admin\AppData\Local\customer5.exe" /SILENT12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\installersetup.exe"C:\Users\Admin\AppData\Local\installersetup.exe" /VERYSILENT /SUPPRESSMSGBOXES12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NQ1UJ.tmp\installersetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-NQ1UJ.tmp\installersetup.tmp" /SL5="$3033C,1018499,780800,C:\Users\Admin\AppData\Local\installersetup.exe" /VERYSILENT /SUPPRESSMSGBOXES13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create Telephone101 start= auto DisplayName= "Telephone101" binPath= "C:\Windows\rssllxyn\Runtimebroker5.exe"14⤵
-
C:\Users\Admin\AppData\Local\uiso9_pe.exe"C:\Users\Admin\AppData\Local\uiso9_pe.exe" /VERYSILENT /SUPPRESSMSGBOXES12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-QDDEB.tmp\uiso9_pe.tmp"C:\Users\Admin\AppData\Local\Temp\is-QDDEB.tmp\uiso9_pe.tmp" /SL5="$3032E,4631642,128512,C:\Users\Admin\AppData\Local\uiso9_pe.exe" /VERYSILENT /SUPPRESSMSGBOXES13⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"14⤵
- Modifies registry class
-
C:\Program Files (x86)\UltraISO\drivers\isocmd.exe"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i14⤵
-
C:\Users\Admin\AppData\Local\any.exe"C:\Users\Admin\AppData\Local\any.exe" /SILENT12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\jg3_3uag.exe"C:\Users\Admin\AppData\Local\jg3_3uag.exe" /SILENT12⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o2xa3r2u.uen\customer51.exe & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\o2xa3r2u.uen\customer51.exeC:\Users\Admin\AppData\Local\Temp\o2xa3r2u.uen\customer51.exe8⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mmpksvpk.tau\gcleaner.exe /mixfive & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\mmpksvpk.tau\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\mmpksvpk.tau\gcleaner.exe /mixfive8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 6569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 6609⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 7649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 8009⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 8729⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 9209⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 11729⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 11809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 11409⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hgs5xv32.nt0\FastPC.exe /verysilent & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\hgs5xv32.nt0\FastPC.exeC:\Users\Admin\AppData\Local\Temp\hgs5xv32.nt0\FastPC.exe /verysilent8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im FastPC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\hgs5xv32.nt0\FastPC.exe" & del C:\ProgramData\*.dll & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im FastPC.exe /f10⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 610⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yltm5znr.1to\FastPC.exe /verysilent & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\yltm5znr.1to\FastPC.exeC:\Users\Admin\AppData\Local\Temp\yltm5znr.1to\FastPC.exe /verysilent8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-D9TEQ.tmp\FastPC.tmp"C:\Users\Admin\AppData\Local\Temp\is-D9TEQ.tmp\FastPC.tmp" /SL5="$10466,138429,56832,C:\Users\Admin\AppData\Local\Temp\yltm5znr.1to\FastPC.exe" /verysilent9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-OJ39Q.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OJ39Q.tmp\Setup.exe" /Verysilent10⤵
-
C:\Program Files (x86)\FastPc\FastPc\Faster.exe"C:\Program Files (x86)\FastPc\FastPc\Faster.exe"11⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"12⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\FastPc\FastPc\Fast_.exe"C:\Program Files (x86)\FastPc\FastPc\Fast_.exe"11⤵
- Executes dropped EXE
-
C:\Program Files (x86)\FastPc\FastPc\Fast.exe"C:\Program Files (x86)\FastPc\FastPc\Fast.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Fast.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\FastPc\FastPc\Fast.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Fast.exe /f13⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
C:\Program Files (x86)\FastPc\FastPc\13.exe"C:\Program Files (x86)\FastPc\FastPc\13.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"12⤵
- Blocklisted process makes network request
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sr1rfnbt.xp0\autosubplayer.exe /S & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\sr1rfnbt.xp0\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\sr1rfnbt.xp0\autosubplayer.exe /S8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqC34E.tmp\tempfile.ps1"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqC34E.tmp\tempfile.ps1"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqC34E.tmp\tempfile.ps1"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsqC34E.tmp\tempfile.ps1"9⤵
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\olhkdj2l.ogd\installer.exe /qn CAMPAIGN=654 & exit7⤵
-
C:\Users\Admin\AppData\Local\Temp\olhkdj2l.ogd\installer.exeC:\Users\Admin\AppData\Local\Temp\olhkdj2l.ogd\installer.exe /qn CAMPAIGN=6548⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exe"C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0xc0,0x1e8,0x7ffbfb01dec0,0x7ffbfb01ded0,0x7ffbfb01dee06⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --mojo-platform-channel-handle=1720 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1672 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --mojo-platform-channel-handle=2092 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2260 /prefetch:16⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2660 /prefetch:16⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3200 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,3097275629661536993,549807028046642114,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5828_1815102986" --mojo-platform-channel-handle=3552 /prefetch:86⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D4164878D263F4EF49EB27D6E0713786 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5A921B259627FC8812A5477EE62F3196 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E30AEB3B9D50A36618AA94EA6C0AEDC22⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7B62F39B16382D72AA7505E9F48319C7 C2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ae0055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\19B4.exeC:\Users\Admin\AppData\Local\Temp\19B4.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
2New Service
1Scheduled Task
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
eb580dc014e8a0ba57b05717d9b2c7a1
SHA11b9f2cb35263b103d05af84a8b41f74186afed72
SHA25659c9f91919d8cf9c0c8dd5089eb737460ee002f17bdc2cf90c4872263c426fd9
SHA512ad031d69240c9e33faad5a7f07e5b524c06fb54f2360095f23a7accf28b17958fb52e40fb01f45498f8c19d00289f1f579b6cb995ec1ad6c468fd27aa33f16df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5MD5
e76686fec5c2554e4d517cea97b70ee0
SHA19a5e81d94c3178afae9d4cabf99b4e5159bfc02c
SHA2564d122af86946dd3f99b7eca4af8151f420db21c627eb6883bac5f12abcdf101b
SHA51261d8cd211e41e73be4d3c7a3966cd2e8e949f11fdd4f3bd4a42b2a476273f1680eb6c7640ecb0cec3e399c25799d150e2631e0ffb6c2b9c6b7c9961d084e7eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0MD5
9413c455af38f14ff664bb49b151903c
SHA19bc0ff597c433f911746eefeb64454e01e1cab50
SHA25695a28fa5a61fd0dbd19799b2ea321bc9a90b56e0a1abe2020e0bbb50339b77c3
SHA512dfcce638b4a8ea8c4c0ea7d69642673df44f18b1fe9c946b9c2e68b04a86243848590b4a444294109467f9e3f0ae71f417c7588592f022093ce441b7cf5c3878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
6a99c4b788faa74c140707d2fac22ae9
SHA18c5fd97af0e99eda147425167a878e5f9c4e2eb5
SHA256c1ce2e1a6f97c2fa62a0950afa09b57a5a7216dda1f56a1d711f972d17cbb7bd
SHA51231673f7f4631feefb699e4c23270e29fb13d4de569daa17171e51f69dfdc52c45c233379e0c601d65dc3d46c21f905c13b65d3853b1ef96d90c137cab2151335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
3168035090977b01e2b15a045297d6cd
SHA1baec8a47d00d0904648b385aca5778d947456dc7
SHA256e57b9ecf72046536715f2b8dfad9f0e5560d325149f0ac80598d2d7a5703744a
SHA512377ac77af3dd55e07683a0ed76df64b517ead18a2ce278f5ca2db41fd5559e44a533ffb325e14ac34186ee03efc483c8841207da042cae3e9ea9ec3eacc63942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
1e134d4a2956e3235d88e18d83f83d80
SHA1026106c60ccec16f570de9c52be06ce44dc517aa
SHA256f4be87287d14d8287f357aa1828dab6cbef8ec37de949a88b5703c604202aa60
SHA512e279e4c29215109a411aa427f56c5509a3c854f4c0f0d9b5aa4b1527b09acde4bcf57590a004dd1554950489ea42d8567758c82b3b246d816845ff5dafd383a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
e4ca53f8921bd7c7b253bb85bd558cf1
SHA198df98bb9f84855235ca8644fd359d063904e399
SHA256ea5ca1e077ce23532489fc59156f39888fbc39ec5d57d3c916c77aeb6cbae8c6
SHA512beba9d77770abd863f77b062c9c361d1d4d696a08f273977da510eb5a605fc28d0fa1b7d9b30f4aac7346265c6106afbacb248199598039ee79ab2272b5fc2c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5MD5
53d6e91e15364348ba3188c0742d1591
SHA195526097fb2bc8e92881a6d09dccafc56dfd3cc6
SHA256bd2ed49632f313d9eebe1a80543bb4f6eaf514014c285657c6f3489fa01a54d9
SHA51272f4804e48be0c01b1370b914862fdb1b5d649088db49509f70ca4d1dfb19961fa696059a37bad46c06409d66d9d3425b1fe578cbf4e0cd696fe46ba2f5b0c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0MD5
f6a368c2ff476f009f9242a9f6285b49
SHA15e997fc6d9393edd248abce90de4f117658f5fc2
SHA2562b34250bdd029785a624cf248cb33ea78147a6f1789fc8b20182766ddeb83ef9
SHA51259d551ef2553761aa95db3204a4d91c1f07cc7032978c93d8b755966f39ad3f4aeb66bda79aad7dc3f8cad0400a8964339118aad21ef15e78bbc8bfb60ebc0c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
8b51618bb2ff5c1697711dfbe944be7c
SHA1b46b03b851b9bdb2285e6a767ded3723d7023260
SHA256e6cb485161587d768a94685a6744ea88c881aae21a4f4c67e3a84a6aa1b7d79a
SHA5127830a34ace19ad5d7157603d81ba91c65fd8ee0db53487e5c8cc8a61512ebf917d1be8e1bca47d00767d50d8544dc8d04b0452ee75dbc9fabba27cb9996c11f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
dbe890be9ff82fc0df2e685aa376056a
SHA11d54d6bef6d84729c5f2e3a0f0a2a8ae472a075e
SHA2560b4c73adbc2e6e094072051eaf05ccc054dc3e43d22214cbe747b4c6671aaddc
SHA5120b749d7eef7553e64e78b02f3d84cf73bd4d2e49c18204b05a770b0d9cde7f6cbf49f011851848b396bcfd0f278e36c826860bc4f138bc8f100394d04697fa45
-
C:\Users\Admin\AppData\Local\Temp\is-Q8E9S.tmp\WiwZ8i_vFloMueNbDjtBxJbY.tmpMD5
89b035e6a5fd0db09a26338bb5af5ff1
SHA19a784d145a596c69578625fd1793d65592d740de
SHA256f1f90b6ffab442821650618d48117fe861d19a783a862d86941e6477a5b26173
SHA51231d2ba520080348ffa2695308dc5e01696b32598b2c525cd745eee429e302617fd8c5d566eed8b627816671898b0783670885a4a63b22c8be56cc343457fefc6
-
C:\Users\Admin\AppData\Local\Temp\is-VH7BA.tmp\DYbALA.exeMD5
57b17d64ef306fc5df1e775eedb31474
SHA10b4474a1c3c753286462510c1afea1a2190c363b
SHA256f29903e3c60769a84c385816c351a595a45dd681fd3ed95715218115b9ef91e0
SHA512d59a5668f8b01e8cc6c7c65afd460115a24250f1c71f4c39a2315521c4d83f15f1bfe4131ae6d6e604ce157604ae50685115071f6f5a804f80d49f9b847b5946
-
C:\Users\Admin\AppData\Local\Temp\is-VH7BA.tmp\DYbALA.exeMD5
57b17d64ef306fc5df1e775eedb31474
SHA10b4474a1c3c753286462510c1afea1a2190c363b
SHA256f29903e3c60769a84c385816c351a595a45dd681fd3ed95715218115b9ef91e0
SHA512d59a5668f8b01e8cc6c7c65afd460115a24250f1c71f4c39a2315521c4d83f15f1bfe4131ae6d6e604ce157604ae50685115071f6f5a804f80d49f9b847b5946
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exeMD5
13b05e37c68321a0d11fbc336bdd5e13
SHA154ff09ccf69316c0c72a23f2bb7bdb1b1fa319cf
SHA2567147f6e289cc0c676b4d679a1c013d4cb0f399594acd5bdd2774911a5bca317a
SHA5127efab007d30321846acde2e0757ca619ded0a78ea46b386739fdebdb8291d2ba99140644bf822b286418e550f6b3d7b994c0efb0c9648af607e51e3ef05125ce
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exeMD5
13b05e37c68321a0d11fbc336bdd5e13
SHA154ff09ccf69316c0c72a23f2bb7bdb1b1fa319cf
SHA2567147f6e289cc0c676b4d679a1c013d4cb0f399594acd5bdd2774911a5bca317a
SHA5127efab007d30321846acde2e0757ca619ded0a78ea46b386739fdebdb8291d2ba99140644bf822b286418e550f6b3d7b994c0efb0c9648af607e51e3ef05125ce
-
C:\Users\Admin\AppData\Local\Temp\sqlite.datMD5
3f2e52bab572f3ba21f8e0f9a8fafbe4
SHA10e88867d28cfaccb0c08acd7ac278de4f535c6b9
SHA256587da47d932c227750ce4ac216b3d876ac03faeb943a07da02bbdc541626668a
SHA512e282393cf251a9d904e5ab0ee0f52c47cb61c5c821020791571faaf199b40b82ad743ba951bffac8ee3783b54fadc7968e92a8020c01dadb766d0d29ade3b351
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
4289fb33691fc61caa9cd0b8c15ea65f
SHA1eda18ca8ca9b7db5c43bd1fb1c7a827a2c2d4e95
SHA256acc2cde2c2e423bc4c115e5bed3d09588629e31d22e469096ce46e6712201a52
SHA512dfc3929eff57b7bdeca65a9e6477cbe192785edfd5d362145d041ca44d77dabc3d5558c3a3902e17c55b2de8873d44e72510a298369d72f0618a6896edec8113
-
C:\Users\Admin\AppData\Roaming\6107403.exeMD5
85bbd12e72891a83ebe657e68d336fb2
SHA1de7f8cc42dbcfec8ad53fae64810beb5d254f101
SHA256dba6decb6d5c842bce0694212f2bb62334292665f487509fc1a5b01e258301b9
SHA512481ef8440c5e36c5b1c9297a9fd5a3441151e0700fb68e2ed8c49359162dc5df1d1d94fd8f9b64472f97d43760b426df978784d86c8fa00153d0c64b4de5d2dd
-
C:\Users\Admin\AppData\Roaming\6107403.exeMD5
85bbd12e72891a83ebe657e68d336fb2
SHA1de7f8cc42dbcfec8ad53fae64810beb5d254f101
SHA256dba6decb6d5c842bce0694212f2bb62334292665f487509fc1a5b01e258301b9
SHA512481ef8440c5e36c5b1c9297a9fd5a3441151e0700fb68e2ed8c49359162dc5df1d1d94fd8f9b64472f97d43760b426df978784d86c8fa00153d0c64b4de5d2dd
-
C:\Users\Admin\AppData\Roaming\6118167.exeMD5
d4afd6e583d54a75f39bf4934b99c684
SHA1c9262e240a4a503d426b47b90c7b6fe6ed8bed9e
SHA2560dca699c7d1729954372be2fe70f5da34521de4aa0e5b504a0f6a1c27b12c3f9
SHA51287a29ea404583acf4eef5b4fe2feab8f16483af0cbe8cdfbc3e96ee41836f48e2e9456d54db734c150e6003d42596f8760e3500ec7ffefb50015b44c854a528f
-
C:\Users\Admin\AppData\Roaming\6118167.exeMD5
d4afd6e583d54a75f39bf4934b99c684
SHA1c9262e240a4a503d426b47b90c7b6fe6ed8bed9e
SHA2560dca699c7d1729954372be2fe70f5da34521de4aa0e5b504a0f6a1c27b12c3f9
SHA51287a29ea404583acf4eef5b4fe2feab8f16483af0cbe8cdfbc3e96ee41836f48e2e9456d54db734c150e6003d42596f8760e3500ec7ffefb50015b44c854a528f
-
C:\Users\Admin\AppData\Roaming\6205814.exeMD5
054ce794ac61cb26b1e268a29d966497
SHA1dad3f71a551b4ed2e5fd62e8649539fc16560f95
SHA256f345d9b1192b6d8ee0ccd8b578c8e6978c6d08bef2f2c580dd87dded4838ccad
SHA512a6e06bd9722ed8ecbf274b596fd5fb0b2b3489110cd1a7d44e6fa3ede7bd95d90d485548652f909e3cd2627edf42851ee76502d9e74d239d1e8b1d5746004ad6
-
C:\Users\Admin\AppData\Roaming\6205814.exeMD5
054ce794ac61cb26b1e268a29d966497
SHA1dad3f71a551b4ed2e5fd62e8649539fc16560f95
SHA256f345d9b1192b6d8ee0ccd8b578c8e6978c6d08bef2f2c580dd87dded4838ccad
SHA512a6e06bd9722ed8ecbf274b596fd5fb0b2b3489110cd1a7d44e6fa3ede7bd95d90d485548652f909e3cd2627edf42851ee76502d9e74d239d1e8b1d5746004ad6
-
C:\Users\Admin\AppData\Roaming\6617674.exeMD5
f50e41bbe3484ac879b5a7646d0086df
SHA11ea0eadfb2791ba3c2bfe7f2e61951e769ccc0e8
SHA256ec9a5087c5d52277f50dcd3a7383cfc38b6c793adcc6cfd685fe5ae38b8ae7aa
SHA5124c55d8c4be76dc1e9d5f615a2d141319519eaca916e4954dc9e4947a92c2463db3c492947bf19b852fbe3fbd54285a0ab05644e2cc86b988462c1c35d3ab9c33
-
C:\Users\Admin\AppData\Roaming\6617674.exeMD5
f50e41bbe3484ac879b5a7646d0086df
SHA11ea0eadfb2791ba3c2bfe7f2e61951e769ccc0e8
SHA256ec9a5087c5d52277f50dcd3a7383cfc38b6c793adcc6cfd685fe5ae38b8ae7aa
SHA5124c55d8c4be76dc1e9d5f615a2d141319519eaca916e4954dc9e4947a92c2463db3c492947bf19b852fbe3fbd54285a0ab05644e2cc86b988462c1c35d3ab9c33
-
C:\Users\Admin\AppData\Roaming\6774750.exeMD5
a20e32791806c7b29070b95226b0e480
SHA18f2bac75ffabbe45770076047ded99f243622e5f
SHA256df24005d51e393ed322bbf354c31485dab121ae0a445a754e08bb7912d9cd146
SHA5126cf6b6aa3d4d82e7f202c5a0d3fd9a1085e05dd136e0532702e61de6e9a09b76eb5ec2add7f3a3e926e304aab928bbc639661cf6380133c8e00c387d4e9f2ca0
-
C:\Users\Admin\AppData\Roaming\6774750.exeMD5
a20e32791806c7b29070b95226b0e480
SHA18f2bac75ffabbe45770076047ded99f243622e5f
SHA256df24005d51e393ed322bbf354c31485dab121ae0a445a754e08bb7912d9cd146
SHA5126cf6b6aa3d4d82e7f202c5a0d3fd9a1085e05dd136e0532702e61de6e9a09b76eb5ec2add7f3a3e926e304aab928bbc639661cf6380133c8e00c387d4e9f2ca0
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeMD5
956343c8fc0ab5700ab42cb96d29e2f9
SHA163efc68299140d54418b785a2bbb9797fb79e7c8
SHA2563d09a7d87e3dd1eddc78b0f26f27226c40f1955f36ebec814c9b146b8412e273
SHA512cb5b778c0c580a85b7d0c1a27543234f339ac1b148391a89fbde36718f9c52ffb9a6f33a748c49d9ca7f4171e2565372af9b63dfb921de07aac524c053b9f411
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeMD5
956343c8fc0ab5700ab42cb96d29e2f9
SHA163efc68299140d54418b785a2bbb9797fb79e7c8
SHA2563d09a7d87e3dd1eddc78b0f26f27226c40f1955f36ebec814c9b146b8412e273
SHA512cb5b778c0c580a85b7d0c1a27543234f339ac1b148391a89fbde36718f9c52ffb9a6f33a748c49d9ca7f4171e2565372af9b63dfb921de07aac524c053b9f411
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
a20e32791806c7b29070b95226b0e480
SHA18f2bac75ffabbe45770076047ded99f243622e5f
SHA256df24005d51e393ed322bbf354c31485dab121ae0a445a754e08bb7912d9cd146
SHA5126cf6b6aa3d4d82e7f202c5a0d3fd9a1085e05dd136e0532702e61de6e9a09b76eb5ec2add7f3a3e926e304aab928bbc639661cf6380133c8e00c387d4e9f2ca0
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
a20e32791806c7b29070b95226b0e480
SHA18f2bac75ffabbe45770076047ded99f243622e5f
SHA256df24005d51e393ed322bbf354c31485dab121ae0a445a754e08bb7912d9cd146
SHA5126cf6b6aa3d4d82e7f202c5a0d3fd9a1085e05dd136e0532702e61de6e9a09b76eb5ec2add7f3a3e926e304aab928bbc639661cf6380133c8e00c387d4e9f2ca0
-
C:\Users\Admin\Documents\9fOhvnhvsaw2HRQXop26b8Xm.exeMD5
7c53b803484c308fa9e64a81afba9608
SHA1f5c658a76eee69bb97b0c10425588c4c0671fcbc
SHA256a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
SHA5125ee38abde2a0e0d419806b21f7b5a2807c27a210b863999ea5e1e5f8785cd24e53d7cae4f13727eb2304e71a85f7cc544029f67eb7eff2e1ed9634105ba9cb11
-
C:\Users\Admin\Documents\9fOhvnhvsaw2HRQXop26b8Xm.exeMD5
7c53b803484c308fa9e64a81afba9608
SHA1f5c658a76eee69bb97b0c10425588c4c0671fcbc
SHA256a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
SHA5125ee38abde2a0e0d419806b21f7b5a2807c27a210b863999ea5e1e5f8785cd24e53d7cae4f13727eb2304e71a85f7cc544029f67eb7eff2e1ed9634105ba9cb11
-
C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exeMD5
13b05e37c68321a0d11fbc336bdd5e13
SHA154ff09ccf69316c0c72a23f2bb7bdb1b1fa319cf
SHA2567147f6e289cc0c676b4d679a1c013d4cb0f399594acd5bdd2774911a5bca317a
SHA5127efab007d30321846acde2e0757ca619ded0a78ea46b386739fdebdb8291d2ba99140644bf822b286418e550f6b3d7b994c0efb0c9648af607e51e3ef05125ce
-
C:\Users\Admin\Pictures\Adobe Films\4D571Ldj7_d5uqCzM4uzPa7R.exeMD5
13b05e37c68321a0d11fbc336bdd5e13
SHA154ff09ccf69316c0c72a23f2bb7bdb1b1fa319cf
SHA2567147f6e289cc0c676b4d679a1c013d4cb0f399594acd5bdd2774911a5bca317a
SHA5127efab007d30321846acde2e0757ca619ded0a78ea46b386739fdebdb8291d2ba99140644bf822b286418e550f6b3d7b994c0efb0c9648af607e51e3ef05125ce
-
C:\Users\Admin\Pictures\Adobe Films\K8v1i_NH2WAmPlPWJhEYncrO.exeMD5
17d00ffe0063ec458371dac451603184
SHA1b0b4d2802cd1c42e8e50f37e2bd03b457fd6b9b6
SHA25622160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c
SHA5127f6b90e03427635c9ee72c4e4c3a90d19c123950391e24ea5f4f232ffb93507055e6269c0998c0a2760e16b341a034d5f949f9d70c7187b5b97624b748308aa1
-
C:\Users\Admin\Pictures\Adobe Films\K8v1i_NH2WAmPlPWJhEYncrO.exeMD5
17d00ffe0063ec458371dac451603184
SHA1b0b4d2802cd1c42e8e50f37e2bd03b457fd6b9b6
SHA25622160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c
SHA5127f6b90e03427635c9ee72c4e4c3a90d19c123950391e24ea5f4f232ffb93507055e6269c0998c0a2760e16b341a034d5f949f9d70c7187b5b97624b748308aa1
-
C:\Users\Admin\Pictures\Adobe Films\OdF7_xtirfO7cc3XPYf5GcAi.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\OdF7_xtirfO7cc3XPYf5GcAi.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\Ph_AwRuELXigvWylgPeTujFx.exeMD5
d56310393202432e4c1e6aa6d705a53f
SHA19305b003ab13ba58d605a3f1abe65ba24c88aca1
SHA2566b3ecb891b60ccad7988ea94c8bd6ebe0d59e73e8ef4888d8cdb86d57a32fc48
SHA5125fd656cef5de16470c0f3a9a722ec6261dafffcb6442d6cb62ee81384e1da757536f81996310513bbdef88ff298eef7f33a03f36f5f206a0ee0d9442fc2a79bd
-
C:\Users\Admin\Pictures\Adobe Films\Ph_AwRuELXigvWylgPeTujFx.exeMD5
d56310393202432e4c1e6aa6d705a53f
SHA19305b003ab13ba58d605a3f1abe65ba24c88aca1
SHA2566b3ecb891b60ccad7988ea94c8bd6ebe0d59e73e8ef4888d8cdb86d57a32fc48
SHA5125fd656cef5de16470c0f3a9a722ec6261dafffcb6442d6cb62ee81384e1da757536f81996310513bbdef88ff298eef7f33a03f36f5f206a0ee0d9442fc2a79bd
-
C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exeMD5
21b1d6eafec6e43d29d156ffafa3095a
SHA1d2553018c881d6fbbeee28ac72ce062db9553fc1
SHA256702c6a4e393de00300db47c456b73bcdc57d684a47e89bb2aad419a163899a76
SHA512199fba53a38613a002b18ef65ed29ff941f4bb03319490354e535babed2d2d83df5908c75e04c2a1e86e2df9ecd3fa5d0b4d3ef0bdac55436e21176191d228ed
-
C:\Users\Admin\Pictures\Adobe Films\Wap3rAoRjyaZsYVRD9RNqtXX.exeMD5
21b1d6eafec6e43d29d156ffafa3095a
SHA1d2553018c881d6fbbeee28ac72ce062db9553fc1
SHA256702c6a4e393de00300db47c456b73bcdc57d684a47e89bb2aad419a163899a76
SHA512199fba53a38613a002b18ef65ed29ff941f4bb03319490354e535babed2d2d83df5908c75e04c2a1e86e2df9ecd3fa5d0b4d3ef0bdac55436e21176191d228ed
-
C:\Users\Admin\Pictures\Adobe Films\WiwZ8i_vFloMueNbDjtBxJbY.exeMD5
975b12b1a5eb94546bc03a18990fc10c
SHA1d8104c5cc01108acb87fee3473c72116e3065c55
SHA25687281b5b33aa80c31a7719633e97e58132909decd57f39bc123bb49fec3c77e6
SHA5125e42516392ebda5c2116d78d496bea1ecde15ccbac00d3feac1e3c7ee6b7925b8675deae3960c47d33de573e690fe0d95bdbd95f8d43f024c39cac294757c2ed
-
C:\Users\Admin\Pictures\Adobe Films\WiwZ8i_vFloMueNbDjtBxJbY.exeMD5
975b12b1a5eb94546bc03a18990fc10c
SHA1d8104c5cc01108acb87fee3473c72116e3065c55
SHA25687281b5b33aa80c31a7719633e97e58132909decd57f39bc123bb49fec3c77e6
SHA5125e42516392ebda5c2116d78d496bea1ecde15ccbac00d3feac1e3c7ee6b7925b8675deae3960c47d33de573e690fe0d95bdbd95f8d43f024c39cac294757c2ed
-
C:\Users\Admin\Pictures\Adobe Films\X6eG4Z2uJmedRHb9Dnal4fff.exeMD5
b29ad6358b274a95ec3ed237591b5302
SHA1c39c4e63757a2bda8e542b6d52fe450d4658c3bd
SHA256b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4
SHA5129aada5aaaaca2fda3857b77b1d81f731cd49be053ae92771913044b4da772bcf8fa82c495cade22699dd1e0e17235c77e248ce90455fa9a627b32a196152adad
-
C:\Users\Admin\Pictures\Adobe Films\X6eG4Z2uJmedRHb9Dnal4fff.exeMD5
b29ad6358b274a95ec3ed237591b5302
SHA1c39c4e63757a2bda8e542b6d52fe450d4658c3bd
SHA256b3cc4f5e81e5595d67a53687265d3fb871993273352844f2b15fbf7d9ba163e4
SHA5129aada5aaaaca2fda3857b77b1d81f731cd49be053ae92771913044b4da772bcf8fa82c495cade22699dd1e0e17235c77e248ce90455fa9a627b32a196152adad
-
C:\Users\Admin\Pictures\Adobe Films\eTrOr8TGRq9B0nMudMF11VDJ.exeMD5
55ca45fa1a66da7da79c32f4f2ccb9b3
SHA12ab9b4dd38b77151a5320761d660e02610140229
SHA25606db89b559ef3dcba01288b4ff00893ac39512fae4c14f218e92ec54d4d333d9
SHA5121fa2c1f79edfb05bd9fe4ffc9777bf02f9a6f31f49941d2617c4e047712d60e1f000381ef2389336272aad63747920c0471ce3f727973df62b82000f0367a985
-
C:\Users\Admin\Pictures\Adobe Films\eTrOr8TGRq9B0nMudMF11VDJ.exeMD5
55ca45fa1a66da7da79c32f4f2ccb9b3
SHA12ab9b4dd38b77151a5320761d660e02610140229
SHA25606db89b559ef3dcba01288b4ff00893ac39512fae4c14f218e92ec54d4d333d9
SHA5121fa2c1f79edfb05bd9fe4ffc9777bf02f9a6f31f49941d2617c4e047712d60e1f000381ef2389336272aad63747920c0471ce3f727973df62b82000f0367a985
-
C:\Users\Admin\Pictures\Adobe Films\hOnADgqE5fQBsL6tFdZeagZ4.exeMD5
697f300ab8adefc3810f4d0007e41e18
SHA1f225c1186d20a9586811979d7f07f18098e436ad
SHA256706c3454dfd83599ce51f95e27c52f5aaf811cff369a63edc3ef0e513c1d4251
SHA5126fdd2ec00cabb2ffa19edf85d01929b123d6a5d895e3460389a79771671c1ec9368c915dde760652495764324e1ee34108b5aa624b4bdfaf9d66aa7512833efc
-
C:\Users\Admin\Pictures\Adobe Films\hOnADgqE5fQBsL6tFdZeagZ4.exeMD5
697f300ab8adefc3810f4d0007e41e18
SHA1f225c1186d20a9586811979d7f07f18098e436ad
SHA256706c3454dfd83599ce51f95e27c52f5aaf811cff369a63edc3ef0e513c1d4251
SHA5126fdd2ec00cabb2ffa19edf85d01929b123d6a5d895e3460389a79771671c1ec9368c915dde760652495764324e1ee34108b5aa624b4bdfaf9d66aa7512833efc
-
C:\Users\Admin\Pictures\Adobe Films\t0uwGfRwNd4zNGKD5cqWEQN9.exeMD5
6d6147dc459a34905e68396a8c554525
SHA1f9c5ae56737c3b4e0d0157f8755f06b091606984
SHA25697c0c04ae83b9599b78f61d809cfb2428984b25a79d2d986dfdbad6858101af9
SHA512e7827ecef737772f877891dd048a53e5a4ce3419c414ffb3f6fbf4676c70475130606af5ac5f5fc66e80b63fd013276d774dc8472f9ba49081baeabd97c99f24
-
C:\Users\Admin\Pictures\Adobe Films\t0uwGfRwNd4zNGKD5cqWEQN9.exeMD5
6d6147dc459a34905e68396a8c554525
SHA1f9c5ae56737c3b4e0d0157f8755f06b091606984
SHA25697c0c04ae83b9599b78f61d809cfb2428984b25a79d2d986dfdbad6858101af9
SHA512e7827ecef737772f877891dd048a53e5a4ce3419c414ffb3f6fbf4676c70475130606af5ac5f5fc66e80b63fd013276d774dc8472f9ba49081baeabd97c99f24
-
\Users\Admin\AppData\Local\Temp\is-VH7BA.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
\Users\Admin\AppData\Local\Temp\nsb44E7.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsb44E7.tmp\System.dllMD5
fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
\Users\Admin\AppData\Local\Temp\nsjC91.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsjC91.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsjC91.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsjC91.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsjC91.tmp\System.dllMD5
fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
4289fb33691fc61caa9cd0b8c15ea65f
SHA1eda18ca8ca9b7db5c43bd1fb1c7a827a2c2d4e95
SHA256acc2cde2c2e423bc4c115e5bed3d09588629e31d22e469096ce46e6712201a52
SHA512dfc3929eff57b7bdeca65a9e6477cbe192785edfd5d362145d041ca44d77dabc3d5558c3a3902e17c55b2de8873d44e72510a298369d72f0618a6896edec8113
-
memory/316-254-0x00000199F7E10000-0x00000199F7E12000-memory.dmpFilesize
8KB
-
memory/316-253-0x00000199F7E10000-0x00000199F7E12000-memory.dmpFilesize
8KB
-
memory/316-274-0x00000199F7E50000-0x00000199F7EC2000-memory.dmpFilesize
456KB
-
memory/804-314-0x0000000000000000-mapping.dmp
-
memory/944-316-0x0000000000000000-mapping.dmp
-
memory/948-327-0x0000000000000000-mapping.dmp
-
memory/948-332-0x0000000000C70000-0x0000000000C72000-memory.dmpFilesize
8KB
-
memory/988-344-0x0000000000000000-mapping.dmp
-
memory/1060-273-0x00000213A1F00000-0x00000213A1F72000-memory.dmpFilesize
456KB
-
memory/1060-268-0x00000213A1590000-0x00000213A1592000-memory.dmpFilesize
8KB
-
memory/1060-271-0x00000213A1590000-0x00000213A1592000-memory.dmpFilesize
8KB
-
memory/1176-266-0x000001D5A0370000-0x000001D5A03E2000-memory.dmpFilesize
456KB
-
memory/1176-263-0x000001D59F3F0000-0x000001D59F3F2000-memory.dmpFilesize
8KB
-
memory/1176-265-0x000001D59F3F0000-0x000001D59F3F2000-memory.dmpFilesize
8KB
-
memory/1232-302-0x000002DC06ED0000-0x000002DC06F42000-memory.dmpFilesize
456KB
-
memory/1232-291-0x000002DC06710000-0x000002DC06712000-memory.dmpFilesize
8KB
-
memory/1232-292-0x000002DC06710000-0x000002DC06712000-memory.dmpFilesize
8KB
-
memory/1252-165-0x0000000002C60000-0x0000000002C61000-memory.dmpFilesize
4KB
-
memory/1252-164-0x0000000002C60000-0x0000000002C61000-memory.dmpFilesize
4KB
-
memory/1252-162-0x0000000000000000-mapping.dmp
-
memory/1328-134-0x0000000000000000-mapping.dmp
-
memory/1344-308-0x000002105A1D0000-0x000002105A242000-memory.dmpFilesize
456KB
-
memory/1344-296-0x0000021059DA0000-0x0000021059DA2000-memory.dmpFilesize
8KB
-
memory/1344-294-0x0000021059DA0000-0x0000021059DA2000-memory.dmpFilesize
8KB
-
memory/1368-176-0x0000000000000000-mapping.dmp
-
memory/1420-179-0x0000000000000000-mapping.dmp
-
memory/1420-208-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1444-275-0x0000021F58850000-0x0000021F58852000-memory.dmpFilesize
8KB
-
memory/1444-277-0x0000021F58850000-0x0000021F58852000-memory.dmpFilesize
8KB
-
memory/1444-280-0x0000021F59200000-0x0000021F59272000-memory.dmpFilesize
456KB
-
memory/1452-171-0x0000000000000000-mapping.dmp
-
memory/1452-192-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1480-232-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/1480-264-0x0000000002CA1000-0x0000000002CA2000-memory.dmpFilesize
4KB
-
memory/1480-209-0x0000000002CA0000-0x0000000002CA1000-memory.dmpFilesize
4KB
-
memory/1480-184-0x0000000000000000-mapping.dmp
-
memory/1512-139-0x0000000000970000-0x00000000009B9000-memory.dmpFilesize
292KB
-
memory/1512-126-0x0000000000000000-mapping.dmp
-
memory/1512-140-0x0000000000400000-0x000000000089B000-memory.dmpFilesize
4.6MB
-
memory/1572-247-0x0000000000000000-mapping.dmp
-
memory/1572-261-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1572-270-0x0000000002DE0000-0x0000000002DE1000-memory.dmpFilesize
4KB
-
memory/1572-282-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/1572-298-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/1572-279-0x00000000054C0000-0x0000000005508000-memory.dmpFilesize
288KB
-
memory/1588-218-0x0000000000000000-mapping.dmp
-
memory/1588-241-0x0000000000D20000-0x0000000000D7D000-memory.dmpFilesize
372KB
-
memory/1588-238-0x0000000000B91000-0x0000000000C92000-memory.dmpFilesize
1.0MB
-
memory/1724-200-0x0000000000000000-mapping.dmp
-
memory/1772-347-0x0000000000000000-mapping.dmp
-
memory/1772-320-0x0000000000000000-mapping.dmp
-
memory/1776-129-0x0000000000000000-mapping.dmp
-
memory/1776-143-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/1776-133-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1776-151-0x00000000009C0000-0x00000000009C2000-memory.dmpFilesize
8KB
-
memory/1852-286-0x00000121E05E0000-0x00000121E05E2000-memory.dmpFilesize
8KB
-
memory/1852-300-0x00000121E1340000-0x00000121E13B2000-memory.dmpFilesize
456KB
-
memory/1852-283-0x00000121E05E0000-0x00000121E05E2000-memory.dmpFilesize
8KB
-
memory/2032-304-0x00000000021D0000-0x00000000021D1000-memory.dmpFilesize
4KB
-
memory/2032-281-0x0000000000000000-mapping.dmp
-
memory/2052-357-0x0000000000000000-mapping.dmp
-
memory/2096-213-0x0000000000000000-mapping.dmp
-
memory/2116-199-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2116-197-0x0000000000000000-mapping.dmp
-
memory/2116-201-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2156-351-0x0000000000000000-mapping.dmp
-
memory/2220-352-0x0000000000400000-0x000000000089B000-memory.dmpFilesize
4.6MB
-
memory/2220-348-0x0000000000000000-mapping.dmp
-
memory/2332-278-0x00000212F54D0000-0x00000212F5542000-memory.dmpFilesize
456KB
-
memory/2332-260-0x00000212F4DE0000-0x00000212F4DE2000-memory.dmpFilesize
8KB
-
memory/2332-259-0x00000212F4DE0000-0x00000212F4DE2000-memory.dmpFilesize
8KB
-
memory/2344-328-0x0000000000000000-mapping.dmp
-
memory/2344-342-0x00000000017F5000-0x00000000017F6000-memory.dmpFilesize
4KB
-
memory/2344-341-0x00000000017F4000-0x00000000017F5000-memory.dmpFilesize
4KB
-
memory/2344-335-0x00000000017F2000-0x00000000017F4000-memory.dmpFilesize
8KB
-
memory/2344-330-0x00000000017F0000-0x00000000017F2000-memory.dmpFilesize
8KB
-
memory/2356-256-0x0000028052F60000-0x0000028052F62000-memory.dmpFilesize
8KB
-
memory/2356-276-0x0000028053830000-0x00000280538A2000-memory.dmpFilesize
456KB
-
memory/2356-257-0x0000028052F60000-0x0000028052F62000-memory.dmpFilesize
8KB
-
memory/2388-153-0x0000000000400000-0x0000000000883000-memory.dmpFilesize
4.5MB
-
memory/2388-138-0x0000000000000000-mapping.dmp
-
memory/2388-152-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2388-145-0x0000000000BD1000-0x0000000000BE2000-memory.dmpFilesize
68KB
-
memory/2548-248-0x0000028B33570000-0x0000028B335E2000-memory.dmpFilesize
456KB
-
memory/2548-242-0x0000028B32AC0000-0x0000028B32AC2000-memory.dmpFilesize
8KB
-
memory/2548-245-0x0000028B32AC0000-0x0000028B32AC2000-memory.dmpFilesize
8KB
-
memory/2596-305-0x000001D341B00000-0x000001D341B72000-memory.dmpFilesize
456KB
-
memory/2596-303-0x000001D340F90000-0x000001D340F92000-memory.dmpFilesize
8KB
-
memory/2596-301-0x000001D340F90000-0x000001D340F92000-memory.dmpFilesize
8KB
-
memory/2624-313-0x0000025385880000-0x00000253858F2000-memory.dmpFilesize
456KB
-
memory/2664-346-0x0000000000000000-mapping.dmp
-
memory/2836-206-0x0000000000000000-mapping.dmp
-
memory/2964-353-0x0000000000000000-mapping.dmp
-
memory/3040-227-0x0000000001470000-0x0000000001486000-memory.dmpFilesize
88KB
-
memory/3212-333-0x0000000002702000-0x0000000002704000-memory.dmpFilesize
8KB
-
memory/3212-331-0x0000000002700000-0x0000000002702000-memory.dmpFilesize
8KB
-
memory/3212-336-0x0000000002705000-0x0000000002706000-memory.dmpFilesize
4KB
-
memory/3212-326-0x0000000000000000-mapping.dmp
-
memory/3212-334-0x0000000002704000-0x0000000002705000-memory.dmpFilesize
4KB
-
memory/3344-169-0x0000000000000000-mapping.dmp
-
memory/3428-319-0x0000000000000000-mapping.dmp
-
memory/3584-196-0x0000000000000000-mapping.dmp
-
memory/3620-214-0x0000000000000000-mapping.dmp
-
memory/3620-229-0x0000000002530000-0x0000000002532000-memory.dmpFilesize
8KB
-
memory/3788-123-0x0000000000000000-mapping.dmp
-
memory/3800-144-0x0000000000000000-mapping.dmp
-
memory/3840-361-0x0000000000000000-mapping.dmp
-
memory/3848-350-0x0000000000000000-mapping.dmp
-
memory/4148-325-0x000001B0D7AF0000-0x000001B0D7B0B000-memory.dmpFilesize
108KB
-
memory/4148-243-0x00007FF7E0A64060-mapping.dmp
-
memory/4148-329-0x000001B0D8A00000-0x000001B0D8B06000-memory.dmpFilesize
1.0MB
-
memory/4148-251-0x000001B0D79F0000-0x000001B0D79F2000-memory.dmpFilesize
8KB
-
memory/4148-269-0x000001B0D61D0000-0x000001B0D6242000-memory.dmpFilesize
456KB
-
memory/4148-249-0x000001B0D79F0000-0x000001B0D79F2000-memory.dmpFilesize
8KB
-
memory/4176-148-0x0000000000000000-mapping.dmp
-
memory/4264-362-0x0000000000000000-mapping.dmp
-
memory/4264-368-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/4292-404-0x0000000005342000-0x0000000005343000-memory.dmpFilesize
4KB
-
memory/4292-408-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/4452-158-0x0000000000000000-mapping.dmp
-
memory/4472-363-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4472-358-0x0000000000000000-mapping.dmp
-
memory/4480-219-0x0000000000000000-mapping.dmp
-
memory/4480-230-0x0000000001030000-0x00000000010DE000-memory.dmpFilesize
696KB
-
memory/4480-246-0x0000000005990000-0x0000000005991000-memory.dmpFilesize
4KB
-
memory/4480-267-0x0000000001030000-0x00000000010DE000-memory.dmpFilesize
696KB
-
memory/4508-115-0x0000000000000000-mapping.dmp
-
memory/4508-122-0x0000000006290000-0x00000000063DA000-memory.dmpFilesize
1.3MB
-
memory/4564-117-0x0000000000000000-mapping.dmp
-
memory/4592-343-0x0000000000000000-mapping.dmp
-
memory/4612-272-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/4612-252-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/4612-240-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/4612-231-0x0000000000000000-mapping.dmp
-
memory/4616-119-0x0000000000000000-mapping.dmp
-
memory/4700-337-0x0000000000000000-mapping.dmp
-
memory/4700-356-0x000000002F560000-0x000000002F60D000-memory.dmpFilesize
692KB
-
memory/4700-355-0x000000002F3C0000-0x000000002F4A1000-memory.dmpFilesize
900KB
-
memory/4764-233-0x00000230F8E00000-0x00000230F8E02000-memory.dmpFilesize
8KB
-
memory/4764-235-0x00000230F9150000-0x00000230F919D000-memory.dmpFilesize
308KB
-
memory/4764-239-0x00000230F9210000-0x00000230F9282000-memory.dmpFilesize
456KB
-
memory/4764-237-0x00000230F8E00000-0x00000230F8E02000-memory.dmpFilesize
8KB
-
memory/4772-354-0x0000000000000000-mapping.dmp
-
memory/5008-345-0x0000000000000000-mapping.dmp
-
memory/5012-156-0x0000000000000000-mapping.dmp
-
memory/5016-204-0x0000000008560000-0x0000000008561000-memory.dmpFilesize
4KB
-
memory/5016-161-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/5016-191-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/5016-168-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/5016-166-0x00000000046F0000-0x0000000004739000-memory.dmpFilesize
292KB
-
memory/5016-177-0x0000000007B30000-0x0000000007B31000-memory.dmpFilesize
4KB
-
memory/5016-194-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/5016-170-0x0000000007430000-0x0000000007431000-memory.dmpFilesize
4KB
-
memory/5016-207-0x0000000007820000-0x0000000007821000-memory.dmpFilesize
4KB
-
memory/5016-159-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/5016-154-0x0000000000000000-mapping.dmp
-
memory/5016-210-0x00000000078C0000-0x00000000078C1000-memory.dmpFilesize
4KB
-
memory/5028-315-0x0000000000000000-mapping.dmp
-
memory/5236-364-0x0000000000000000-mapping.dmp
-
memory/5256-365-0x0000000000000000-mapping.dmp
-
memory/5256-369-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/5364-370-0x0000000000000000-mapping.dmp
-
memory/5376-373-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/5376-371-0x0000000000000000-mapping.dmp
-
memory/5448-379-0x0000000000400000-0x000000000089B000-memory.dmpFilesize
4.6MB
-
memory/5448-377-0x00000000008A0000-0x00000000009EA000-memory.dmpFilesize
1.3MB
-
memory/5448-372-0x0000000000000000-mapping.dmp
-
memory/5560-378-0x0000000000000000-mapping.dmp
-
memory/5608-383-0x0000000000750000-0x00000000007FE000-memory.dmpFilesize
696KB
-
memory/5608-380-0x0000000000000000-mapping.dmp
-
memory/5776-381-0x0000000000000000-mapping.dmp
-
memory/5828-385-0x0000000000000000-mapping.dmp
-
memory/5856-386-0x0000000000000000-mapping.dmp
-
memory/5996-393-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/6060-400-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/6060-411-0x0000000003050000-0x0000000003051000-memory.dmpFilesize
4KB
-
memory/6084-414-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB