f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67

Analysis

max time kernel
188s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
15-02-2022 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe
Size

5.8MB
MD5

06cf336ef24ea048430e0942112eec57
SHA1

2a840ddcffac74700807b9cdfe6069ad9de95b4b
SHA256

f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67
SHA512

e69388825397acb2f7c470f4dedcd19cf4451b9f8b25660e99d9c926f7f0c1aef0e987fa86bde70890a7999d60f5249a38eea0cdfce95132e6c80fa02a52ef19

Score

10^/10

evasion themida trojan

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 3160 created 3968 3160 WerFault.exe SearchApp.exe
PID 544 created 2312 544 WerFault.exe SearchApp.exe
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

80 872 WScript.exe
Executes dropped EXE 3 IoCs

Processes:

arlinevp.exenebris.exeIntelRapid.exe

pid process

636 arlinevp.exe
3336 nebris.exe
1876 IntelRapid.exe

description	pid	process	target process
PID 3160 created 3968	3160	WerFault.exe	SearchApp.exe
PID 544 created 2312	544	WerFault.exe	SearchApp.exe

flow	pid	process
80	872	WScript.exe

pid	process
636	arlinevp.exe
3336	nebris.exe
1876	IntelRapid.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nebris.exearlinevp.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nebris.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	arlinevp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	arlinevp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nebris.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

arlinevp.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	arlinevp.exe

Drops startup file 1 IoCs

Processes:

nebris.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk nebris.exe
Loads dropped DLL 1 IoCs

Processes:

f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe

pid process

2608 f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	nebris.exe

pid	process
2608	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\farleu\arlinevp.exe	themida
C:\Users\Admin\AppData\Local\Temp\farleu\arlinevp.exe	themida
C:\Users\Admin\AppData\Local\Temp\farleu\nebris.exe	themida
C:\Users\Admin\AppData\Local\Temp\farleu\nebris.exe	themida
behavioral2/memory/3336-135-0x00007FF6D2A90000-0x00007FF6D334F000-memory.dmp	themida
behavioral2/memory/636-137-0x00000000005B0000-0x0000000000C1B000-memory.dmp	themida
behavioral2/memory/3336-136-0x00007FF6D2A90000-0x00007FF6D334F000-memory.dmp	themida
behavioral2/memory/636-138-0x00000000005B0000-0x0000000000C1B000-memory.dmp	themida
behavioral2/memory/636-141-0x00000000005B0000-0x0000000000C1B000-memory.dmp	themida
behavioral2/memory/636-142-0x00000000005B0000-0x0000000000C1B000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
behavioral2/memory/1876-145-0x00007FF733AE0000-0x00007FF73439F000-memory.dmp	themida
behavioral2/memory/1876-146-0x00007FF733AE0000-0x00007FF73439F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

nebris.exearlinevp.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nebris.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	arlinevp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

64 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

nebris.exearlinevp.exeIntelRapid.exe

pid process

3336 nebris.exe
636 arlinevp.exe
1876 IntelRapid.exe

flow	ioc
64	ip-api.com

pid	process
3336	nebris.exe
636	arlinevp.exe
1876	IntelRapid.exe

Drops file in Program Files directory 3 IoCs

Processes:

f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe

description	ioc	process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3748 3968 WerFault.exe SearchApp.exe
3480 2312 WerFault.exe SearchApp.exe

pid	pid_target	process	target process
3748	3968	WerFault.exe	SearchApp.exe
3480	2312	WerFault.exe	SearchApp.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exearlinevp.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	arlinevp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	arlinevp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exeWerFault.exeSearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.555673"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132895507789479897"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4328"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.555584"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4108"	svchost.exe

Modifies registry class 50 IoCs

Processes:

SearchApp.exearlinevp.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings	arlinevp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6690"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2291"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2291"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6002"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6002"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6690"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1980"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1980"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6690"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2291"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1980"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6002"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

IntelRapid.exe

pid process

1876 IntelRapid.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

arlinevp.exeWerFault.exeWerFault.exe

pid process

636 arlinevp.exe
636 arlinevp.exe
3748 WerFault.exe
3748 WerFault.exe
3480 WerFault.exe
3480 WerFault.exe

pid	process
1876	IntelRapid.exe

pid	process
636	arlinevp.exe
636	arlinevp.exe
3748	WerFault.exe
3748	WerFault.exe
3480	WerFault.exe
3480	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe
Token: SeRestorePrivilege	3988	TiWorker.exe
Token: SeSecurityPrivilege	3988	TiWorker.exe
Token: SeBackupPrivilege	3988	TiWorker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SearchApp.exeSearchApp.exe

pid process

3968 SearchApp.exe
2312 SearchApp.exe

pid	process
3968	SearchApp.exe
2312	SearchApp.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exenebris.exearlinevp.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 2608 wrote to memory of 636	2608	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe	arlinevp.exe
PID 2608 wrote to memory of 636	2608	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe	arlinevp.exe
PID 2608 wrote to memory of 636	2608	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe	arlinevp.exe
PID 2608 wrote to memory of 3336	2608	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe	nebris.exe
PID 2608 wrote to memory of 3336	2608	f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe	nebris.exe
PID 3336 wrote to memory of 1876	3336	nebris.exe	IntelRapid.exe
PID 3336 wrote to memory of 1876	3336	nebris.exe	IntelRapid.exe
PID 636 wrote to memory of 3164	636	arlinevp.exe	WScript.exe
PID 636 wrote to memory of 3164	636	arlinevp.exe	WScript.exe
PID 636 wrote to memory of 3164	636	arlinevp.exe	WScript.exe
PID 3160 wrote to memory of 3968	3160	WerFault.exe	SearchApp.exe
PID 3160 wrote to memory of 3968	3160	WerFault.exe	SearchApp.exe
PID 636 wrote to memory of 872	636	arlinevp.exe	WScript.exe
PID 636 wrote to memory of 872	636	arlinevp.exe	WScript.exe
PID 636 wrote to memory of 872	636	arlinevp.exe	WScript.exe
PID 544 wrote to memory of 2312	544	WerFault.exe	SearchApp.exe
PID 544 wrote to memory of 2312	544	WerFault.exe	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe
"C:\Users\Admin\AppData\Local\Temp\f111930e062e49c9147f1fb3c078ca745c19a05c2f72396753ff0bddf521fc67.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2608

C:\Users\Admin\AppData\Local\Temp\farleu\arlinevp.exe
"C:\Users\Admin\AppData\Local\Temp\farleu\arlinevp.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qpduyst.vbs"
3⤵
PID:3164

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gwoshdjps.vbs"
3⤵
- Blocklisted process makes network request
PID:872

C:\Users\Admin\AppData\Local\Temp\farleu\nebris.exe
"C:\Users\Admin\AppData\Local\Temp\farleu\nebris.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3336

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:1876

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3156

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3968 -s 4276
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3968 -ip 3968
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2312 -s 3864
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3480

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 2312 -ip 2312
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
54e9306f95f32e50ccd58af19753d929

SHA1
eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

SHA256
45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

SHA512
8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
89945b46c732003ce922e31f719a7cc1

SHA1
e469abfd825522a563143949b31fa1eed5567dbf

SHA256
1ffbdad121c64deeae34cbbc7151a85ef7e0032d499595b4990751d30aa7ad6d

SHA512
bcde12633b9cb53fb214c12731fdb657d56f5babd010dc8b565366664689968fb8b0f1e728a70603db03a114d7c14bd2a1688be764a8b1edbec4f223897904e3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\98-tFzBbrLP3oaKdmZtyZ4BBBI4.br[1].js
MD5
129776db6ba6bea4af70cdb1ea56942a

SHA1
12bfe666c0b57b134e7b8b88bcf1a0c3b5dcf3cd

SHA256
2d55886903198e35295b8e90738da47859837baba26d47e15bac87f90ee608d3

SHA512
aedf99a152b97be6a57f0d1fb1dd43b0bb69508eae65b3a054024cd9e5dd59670ebeaff6ce7525e2b7263bbd7c963c30659628f9a2df16410674871538def94b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\BQR--Mi6Hdug9aUgfjMzORag63E.br[1].js
MD5
e515e69b21c49a355d5d4b91764abe00

SHA1
7571f85095e21ba061631d8a38d18623bcabf301

SHA256
365f8b7a23865ca36d1c1f7a25553afddb6223ff524b56d4beb80fdd98c8e057

SHA512
aa38791ce4ed4039a6d63cf6273be8ca0dde2436b8c6e0451937a85652d1c6ea22f38da9fd81ba9a4e877861b507603c88cacbbffe4e6b30ec602396f2b87a81

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\HOhdXCKkBPR8PmokqHlb8CDEo80.br[1].js
MD5
84a0c76f3f238f7042f2b66d630e2394

SHA1
8e01fa294bde8506779debbec69a8be6a96229be

SHA256
b6054f01a5caec71547c334bc317df0c327be6a65d9dd4dd99b0ae169e0845bb

SHA512
7bc240122219f4badd8b30f9e10be854975ebd0fc8b7ebf4e0d944645d52a5619087628476770b29b1ada6ce7145773d27ce1525c6ce0cdc75f725b5b5846368

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\HXQOmZnHKkJYgneadHww_IjOlxQ.br[1].js
MD5
8cd6f73e00f396b041f5a788f07d0f7e

SHA1
c2bbd29a876f140bdb76caea42e38cdc8ab98cef

SHA256
f6ee1bf110376f94b564e95a516562d214c1ff7bddf1b6080848cd855549d955

SHA512
a6b910f4a010ddb4fe7b3387fd58c3fe41b3cfd8afdc535293363c3775fa7cdd7c35613d0e5a40411cc76492eb069744655eb66049464163b6fc1468ec9822b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\HspBKvp4yTgrXo_p0J4XbIuuGuw.br[1].js
MD5
f64820ea8406646c68547983002f25fe

SHA1
204a38feb58c082f6361a3c1072c10575b02fff7

SHA256
0a63f13c0c05b9027bd896780b1ee99c30db9bf5b377a318d5b3211ffb9a3ee3

SHA512
ece265cae6978a1b88a5821e6d2a90adc6607131b8e2165adf15025c723fbf864f2ff1695a83a124110d7321ef7c0834f3160d44ab28cae1902f6bd9700999c6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\Init[1].htm
MD5
9e370e9718718a9e5bfed792e643d4c7

SHA1
17a74437bb5b48f6039ff60b18e496e96cb7a98c

SHA256
a7c7efc669850a439ebf97ac7ff402bc2a9e05ff300b868b4c0346d0fee7a7e3

SHA512
3b367525e222c9bad82c447acf18133328cee64ad56ff153f85621227a2052f302e99d948e3496497597c1ebba24ba6e6fd2ad4ed7528b1738122931faa9fea8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\MDqPc1m5c6NCOcjcf9QO_UfJAUI.br[1].js
MD5
ad2956117b3bb3b8ded1d5a8945728bd

SHA1
ce98bf78b2076eeb264366999e5d390ab506b8ad

SHA256
f056e55c0288ea309b2a0df00efc4da32f79f4abc9ec851e20fae2831dc5f3bc

SHA512
8c991c7db99ffd12e607dc6a05a2da7369b8d2a6a6760682d670e2cde30d92cef511f522f1cfedd8e20a6cc91b1d766832fa89830c495cac992316049d8a2c02

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\MOF_GzvGOii0VGtOHdGSeaiR5wU.br[1].js
MD5
0f840e90799c8d250ea8ea2234595c48

SHA1
eb98e01f0d08cc8bd1db90c4fa0cf44a5f0f8d18

SHA256
60a08c1085b345c14ba09682600a94167ba4e17774ceabff3f9e605c962c3dd8

SHA512
8acaac7d5b3bd37014c70c442b40f50315a237b4decf75242da52b66a471f497bb02ecb7d13365e398a208280ff0a2c36f017b72a02d671767942ebe6c293bfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
MD5
77373397a17bd1987dfca2e68d022ecf

SHA1
1294758879506eff3a54aac8d2b59df17b831978

SHA256
a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13

SHA512
a177f5c25182c62211891786a8f78b2a1caec078c512fc39600809c22b41477c1e8b7a3cf90c88bbbe6869ea5411dd1343cad9a23c6ce1502c439a6d1779ea1b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\U006EeMfq1iK7IAAM8DJcfY519o[1].css
MD5
17d579f86147ac3b11056da41a9d5e89

SHA1
a2b67ea1edfaa6591541d9169bdd0b91efa1efbb

SHA256
b0595825dff390fcf05e06dd2d9e52a8fd1f0fba04c53a56fd38b0faedaf1fdb

SHA512
f54c5ec8ee0d5544589880bdce0a7ac3858bab338c75231d39a13c6df1ddfbfa8868645822380fceb65c265ab85415786c9fd6a16710c2580a627f14220d702e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\WHnOpzzEZzQlWY6EuSOq71UjlFQ.br[1].js
MD5
a8b8e973c9c03929909468b4f8948fd1

SHA1
a74e8b038275662b495b3675f5d16951ac6bc36f

SHA256
cff0579a26d744de2486d7699d0b05df1de4e51ffd2e58c8aa21d3c5eb62e74d

SHA512
ee27cfbfc501a74668bb2a720d81569956a31897d5877afd30c238a772c7cf525a9fa4deade5a01413701cac9656576ffc2aae5b04c25a567fa4f0b7c1f795ad

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\Yi3Flkft8YS8nbd9qCHjIlXAHPg.br[1].js
MD5
6859b06c69a93bd325d6cdb2a5cecbd4

SHA1
5f1b96c6e59054c14d1ee9a3f3a2cbbc70e03b87

SHA256
6a232348034a0564b74d8a293ac8dc15664e26664cd4e071e1d2e740b76d9ec6

SHA512
9166d92cbf6945282259a2ca8d53f6d5986ff81de3d61c191d44a745b093936e21e71132833cb885a829c9bf9e4ce42618bd5e995b7a24929436615df35e91ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\_6kcejpIrJTtxudclBiss_A-0_g[1].css
MD5
5fa42803ad27f35eef70ccfb471435d5

SHA1
fe74ed39acfc0e18885dbf1c61b04d87e44bdeb6

SHA256
f611daf8888d818ab050660b581cf108816c7141f2f8d3fbff3deb7b3448c1b4

SHA512
6ad4793ae7834d9fc019f2df535a58e34fd8da2cf9d280770003690777d13ade78a3065af4a7f8fcdf8e80b880c0f9f39ea42a65a8924e2a64fed102116a13d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\_F0M0yoTmc2b-_eS3W0Eu-fGENs.br[1].js
MD5
e86abefe45e62f7e2f865d8a344d0b6f

SHA1
5d4a0a597759412da2b8e9efd1affe8305e7d116

SHA256
5d54790c856ce13811590e18ac3b0aceefefb61258852490f4c5c60748365e89

SHA512
7903c3046865e3d1db040d66b2c052e3e56f791bc035c56d5fc76b28166dc88fdf6212699f98ee598fa6ba76222dd2da9e428f6662430776edbb4982a232c595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\h6VZ4iIbyChYfadWUA6ReyL9idw.br[1].js
MD5
2c75b361270ca14823bc117ba8e3a16e

SHA1
d3369bffe1e8c3aa1b658fe883cc22d5c73b5c1b

SHA256
c52a925ef0b8d1aaea86529c6c8968e2b86ce46be890dfac0a4a4cc9e29ef0e3

SHA512
ed09c8dfdfc7c86f00d368850f0f3e7bace196de82e5bfddfde4a3d4ff4f54c40e0b7bc613a385b03eb6a39d44d2643f9e456b9593836cfd8df8ca8950c597bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\jz5JHWe_2WCod7u1RNWmByRezL4.br[1].js
MD5
e9e0f2c7d9ff4e7ba872a004593454b5

SHA1
2db69a5f85d5afd2c523f8f6b8867eaa4e1125f9

SHA256
24d847fbf4fd59be3529fdfa7542fd3fe9512662927dd482e60d11344175e778

SHA512
f01ac1fed499aab6465f3f1fea96b5036043c260dd8a9029046895768794503264a98e41cc306f54557eac74c228af9a65a1e6cbdcfe6b4e0e8bbbd730f6a6a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\jzH1hobOIMdex5kjKGOrhxXGVbk.br[1].js
MD5
fe84c629905f642872f9140a994fd7c2

SHA1
547c535b76b5cdd52328dea285d1e977ab5cb8d0

SHA256
0e97eee2037af3f844f2f52541569d2df8706689e0e0d4b209212adf6d43dcf4

SHA512
cb17019a692396df8cac8601265a3057f7c13975a415a9350b8e9d45e1cf5a8befb6ac85b6d42adacfb492c248665d078cd25b2a661fe70863ef3bb833c4dab5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\n0tAjrh0OUxqjqlSPvO1hybRfiY.br[1].js
MD5
7eb9fffdd41917ea831cadcb06973122

SHA1
1602980da42cfb114acb040f5b065b309f4825b8

SHA256
f36fc58ba6d065464053feed391c1a5d6771af7ffaa4a141ac313a1e08b8e527

SHA512
5880db8d3296978bb6a684ac1465ff55c9a0e7e0fe4dc61c48ad6b22f0a59e4bd88d37fc45a71a3de505da25352ee26d014f91de5b82df66e89d1a2f24507493

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\obTY3qKq0d8OC7nv1dy1IdMW4CA.br[1].js
MD5
a1ef6743d774fc65c9d28fbfa6445c61

SHA1
5ecec227bc3fa6e4c6f8e20bef490855a76976fe

SHA256
3283bbec60497f7fb896e1b4af3f65423b860992c72d3fbce565ee02f22dcb4f

SHA512
ead9d5995938903a5a9c7af87e481b191ffcd9e3bf810900aca11b40e5557f26da23faf0629892ae58e11b1a94231a0ee73062f4a92e35bd1dda071a2736c154

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\onra7PQl9o5bYT2lASI1BE4DDEs[1].css
MD5
d167f317b3da20c8cb7f24e078e0358a

SHA1
d44ed3ec2cde263c53a1ba3c94b402410a636c5f

SHA256
be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad

SHA512
afc65b0fa648d49a5eb896be60331aa222301894e228fe5684399e9276342f6510773dffa3e7e75b8d6197bc51c732bc7fd7518e593ecd20c4884c47058d46d8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\s1QRPzn0kGP9oIe5MgvHjNWUeTg[1].css
MD5
d586d74b25707cc825084d7cf28b7d4c

SHA1
282d0ab4dd664394ec2e27cd397aa5a4b300a2df

SHA256
17b4fe5c808876dd59a4850611abacfce27db632fd2ad6319c3edca091908b3d

SHA512
4c460f9a1d7a07b848e3cf9b5bc850055f7831ec56d37c41ada05765f81142e55322a53b88c587a53618a9b9426740dd11595eaeddf0f38b8a81a0a459bc0805

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\tUWuyrvoBg6nl4pYbN1MpS_9cCI.br[1].js
MD5
49e407560d19719fa0e87ecb0a20abb9

SHA1
bd4c25762056256da805893c7409cb423ec20b95

SHA256
b400da645d6ab5fcf581538501e97278f255dc975454c84e07875a2320571045

SHA512
ae402a1805e828ead281b96304019aaf6980cffb8e39e40413b9d5c89a2078c73423f0cdfcf2e4a25518fae9e42f660c81955288fa28d1bb62e7f6dd2cfa3595

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\weVEqwvEjQTO1AQLhywy4-gNLgw.br[1].js
MD5
ffdab333e6bdfc440d52fd0981b242b8

SHA1
70fbea15c005216ae985f4c3ef83ac2e7c50711c

SHA256
a1706ffd6a8f21a07879826d0a5aa653483a2767b806de53ee208e5e0b4483a7

SHA512
c8affed8c9bb548dfcbcedaad4a1f05b0de62889a11353b78ae986fbb161202324766baf9d1125e72a4451771e28828cc980d9348769f321c24f4e203ad5c8fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\x0Cvpg0MmmBx9EUGxLDfa2xcV-E.br[1].js
MD5
23c987e711c002d4ca3cd02deedc9bbf

SHA1
c0c26b66ea6793fa884f143e76cb9ad2e0109c7c

SHA256
a1c2f4c8ca6113ebdac36f2c33d6ce19bcf2f4bd99ec06e8ba845e2b25b03322

SHA512
969bc04d69f629f08585c7c2ee23e998d8c91146b912370cf9886a7f0b067e68654a9581c0203da522d30533871e41c1b96bf60f18091b6c7eb86d1a863b5d06

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\yLw8UJGayIuyEZYZz_kiIpwFap0.br[1].js
MD5
aec8bffc4876fac398ada7a8c4bbc6b9

SHA1
fd7b7c8bfc3127e7327f0f6888b9251af02b2e33

SHA256
a35fb98b59519adc7c7559c5b5106c9a676650d777f040591c329ef24ffd5b56

SHA512
3ec76009cc69e8598ffdfaf1c0981344798739f09e2c489ae795162d7373d055312ff9220ab5ba4920cf8595b91d195c2373427a2706b859b78ff7373bae6a86

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\MLE6WXZB\11\zEQqhwKoETyGdQapOnP2uL1FFF0.br[1].js
MD5
30f68a3ea9f8fe63101e59ced32fa3e7

SHA1
0450964533a5363f20fd7a7ae16821cdfc1fcc1d

SHA256
90fccf6342d5bcfde3f69f88b80253ec694b9b901cc55fd84a2e0c6e0ff05caf

SHA512
f994377757539611fe2781b6aeedcfe2b2c7073516c0f3887c0fd836e1ed69066daabe7065dae1fc4aa071f8f5080939591b3ebd4642b1eaa42c7b25c2003349

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\INetCache\CU387W9N\fFSXkj1t_zfXRNULqSUNux82Lcw[1].js
MD5
4f97cdbdb0fa8bf1cb77389c60e17c55

SHA1
6ff3550b0125ced54e298ea5524177e0340ee7d9

SHA256
612cf023657f77a9562eb932196bc955ee924ba71e7f45e71d64a14c60130822

SHA512
71ff47996aadd361eedfe96da581243e8561bf1582ab71edbce604714e17b1c5a9249004f6447e486082f6984a3342a80bbc14709c670d886722fb031c92875e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RU1N0LOI\www.bing[1].xml
MD5
65b4539e562fd570839ee42fdf333a59

SHA1
88cdae22d33dd4847412716cdb26b5291d8cc951

SHA256
56e97d49ca84863e727b256b21350bc7668dc7b4992e20ca4c0098ce35c6fb60

SHA512
43eb9e7daf7a679af372bbd7fd23496d701be7c15f43f99c37aafbd9a957e3d8cfc8cb0a383395ab7dc338eed1fd7e574b0dabd1c24eff0dfbd51a116b6104f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\farleu\arlinevp.exe
MD5
a287d97f20d4608c53d2bc5e9d64b94d

SHA1
b3a444db0d000a7905987dc445ecfee9bb3990fc

SHA256
41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8

SHA512
1a2324eaff128cc6d62686b565bb108b6b4aeab12d662d329ffcc327eac812958b48b8e0b6dc07f1fc3f30597775074db14f6ec556b34a6c8d75810281ac4260

Download Submit
C:\Users\Admin\AppData\Local\Temp\farleu\arlinevp.exe
MD5
a287d97f20d4608c53d2bc5e9d64b94d

SHA1
b3a444db0d000a7905987dc445ecfee9bb3990fc

SHA256
41a98f1b2ee8d81ec81b8cc9433424a8f7f9f9e513f8bcaab7a7ba1c522313d8

SHA512
1a2324eaff128cc6d62686b565bb108b6b4aeab12d662d329ffcc327eac812958b48b8e0b6dc07f1fc3f30597775074db14f6ec556b34a6c8d75810281ac4260

Download Submit
C:\Users\Admin\AppData\Local\Temp\farleu\nebris.exe
MD5
43e7b1394b43cc9c8a13dc0676170559

SHA1
c4b03f3af66d75607014440ba83a1fcbf985b924

SHA256
d601b5b83695cb9fb5b86cfd176a3457376e9d73e252b71429806593a9589de4

SHA512
020b59329ddbf35197faae13de00b7e6ef9ef29923f63a538d5b9b74f19125ad4a4ef53dd35349e21783f61557f247919e9a5bc85ae743961827efe2692aadca

Download Submit
C:\Users\Admin\AppData\Local\Temp\farleu\nebris.exe
MD5
43e7b1394b43cc9c8a13dc0676170559

SHA1
c4b03f3af66d75607014440ba83a1fcbf985b924

SHA256
d601b5b83695cb9fb5b86cfd176a3457376e9d73e252b71429806593a9589de4

SHA512
020b59329ddbf35197faae13de00b7e6ef9ef29923f63a538d5b9b74f19125ad4a4ef53dd35349e21783f61557f247919e9a5bc85ae743961827efe2692aadca

Download Submit
C:\Users\Admin\AppData\Local\Temp\gwoshdjps.vbs
MD5
e7d4afc4fe96429b0334fd613627acba

SHA1
eaab6a93e8e0fea59fdc861f41e8672074f1c881

SHA256
955c35062a1fae0fbdc665494a3c3e3b5e785d7518c2fcb7beaad46e6111f296

SHA512
1aafbea9d7149b31b799aa70b3b64ec0835428c17b2f223b5f75540d7680d8afb700f96e34c88f1109e0d2be1fe84c19832a17cae52ce1567609f5fad15551ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaBC93.tmp\UAC.dll
MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpduyst.vbs
MD5
527c808fd37f7660307d03acc953721e

SHA1
3e209f039b81865f8a3978105917dd542cc6fe00

SHA256
326c52c795500d45f48f1a748d33912a39a4bada2811a77a7fd7e8501de048d0

SHA512
df5a5844ba24495cfb34da42268d89d0532c0405b92a2392203b4727d3db216321ee680b5af5fe2eb22281bdb459e4939c0c49f0c6d3d98e823b3e35a79a06b2

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
43e7b1394b43cc9c8a13dc0676170559

SHA1
c4b03f3af66d75607014440ba83a1fcbf985b924

SHA256
d601b5b83695cb9fb5b86cfd176a3457376e9d73e252b71429806593a9589de4

SHA512
020b59329ddbf35197faae13de00b7e6ef9ef29923f63a538d5b9b74f19125ad4a4ef53dd35349e21783f61557f247919e9a5bc85ae743961827efe2692aadca

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
43e7b1394b43cc9c8a13dc0676170559

SHA1
c4b03f3af66d75607014440ba83a1fcbf985b924

SHA256
d601b5b83695cb9fb5b86cfd176a3457376e9d73e252b71429806593a9589de4

SHA512
020b59329ddbf35197faae13de00b7e6ef9ef29923f63a538d5b9b74f19125ad4a4ef53dd35349e21783f61557f247919e9a5bc85ae743961827efe2692aadca

Download Submit
memory/636-141-0x00000000005B0000-0x0000000000C1B000-memory.dmp

Filesize
6.4MB

Download
memory/636-137-0x00000000005B0000-0x0000000000C1B000-memory.dmp

Filesize
6.4MB

Download
memory/636-138-0x00000000005B0000-0x0000000000C1B000-memory.dmp

Filesize
6.4MB

Download
memory/636-140-0x0000000077094000-0x0000000077096000-memory.dmp

Filesize
8KB

Download
memory/636-142-0x00000000005B0000-0x0000000000C1B000-memory.dmp

Filesize
6.4MB

Download
memory/1876-145-0x00007FF733AE0000-0x00007FF73439F000-memory.dmp

Filesize
8.7MB

Download
memory/1876-146-0x00007FF733AE0000-0x00007FF73439F000-memory.dmp

Filesize
8.7MB

Download
memory/3336-135-0x00007FF6D2A90000-0x00007FF6D334F000-memory.dmp

Filesize
8.7MB

Download
memory/3336-136-0x00007FF6D2A90000-0x00007FF6D334F000-memory.dmp

Filesize
8.7MB

Download
memory/3336-139-0x00007FF827FB0000-0x00007FF827FB2000-memory.dmp

Filesize
8KB

Download